Privilege (computer science)

A privilege in a computer system is a permission to perform an action. Examples of various privileges include the ability to create a file in a directory, or to read or delete a file, access a device, or have read or write permission to a socket for communicating over the Internet.

Privileges can either be automatic, granted, or applied for.

An automatic privilege exists when there is no requirement to have permission to perform an action. For example, on systems where people are required to log into a system to use it, logging out will not require a privilege. Systems that do not implement file protection - such as MSDOS - essentially give unlimited privilege to perform any action on a file.

A granted privilege exists as a result of presenting some credential to the privilege granting authority. This is usually accomplished by logging on to a system with a username and password, and if the username and password supplied are correct, the user is granted additional privileges.

A privilege is applied for by either an executed program issuing a request for advanced privileges, or by running some program to apply for the additional privileges. An example of a user applying for additional privileges is provided by the sudo command to run a command as the root user, or by the Kerberos authentication system.

Modern processor architectures have so-called "privilege levels" (at least 2, usually referred to as "user" and "kernel"/"supervisor"). The basic idea is to tag tasks with a "privilege level", and resources (segments, pages, ports, etc.) and the so-called "privileged instructions" with a "demanded privilege level". So when a task tries to reach some resource, or execute some privileged instruction, the processor can tell whether it has the permission to do it (if not, some "protection fault" interrupt should be generated). This way e.g. user tasks cannot damage the OS or each other.

For example, the i386+ processors have 4 privilege levels (#0 with the most, and #3 with the least privileges).