Privilege revocation (computing)

Privilege revocation is the act of an entity giving up some, or all of, the privileges they possess, or some authority taking those (privileged) rights away.

Law terminology

In law the general term is often used when discussing some paper, such as a drivers licence, being voided after a (negative) condition is met by the holder.

Information theory

Privileges maybe revoked either to enforce authoritative mandate, or to aid in the reliability of computing services provided. The reasoning behind this being: chances of restarting such tasks maybe better as unaffected jobs may not be effected (or at least probably not as much as in the alternative case: i.e. a privileged process gone haywire instead). Implementation may be at the application or kernel level; or a combination thereof.

Computer security

In computing security privilege revocation is a measure taken by a program to protect the system against misuse of itself. Honoring the principle of least privilege at a granularity provided by the base system, such as sandboxing of (to that point successful) attacks to an unprivileged user account, helps to reduce risk of privilege escalation.

Privilege revocation can be seen as a variant of privilege separation whereby the program terminates the privileged part immediately after it has served its purpose; using the setuid system call, or a similar operating system feature. Revocation of privileges is a technique of defensive programming.