Privilege Separation

Security Patterns

Meaning

Privilege separation is a security design pattern where a program splits its operations into privileged and unprivileged components, limiting the damage that can be done if the less trusted part is compromised.

Primary Function

Security architecture

Communicative Purpose

Reduce attack surface by isolating high-privilege code from the rest of the application.

Pattern

if process_has_privileges(): child_pid = fork() if child_pid == 0: drop_privileges(target_user) run_unprivileged_work() else: continue_privileged_work()

Core Structure

if ...: child_pid = fork() if child_pid == 0: drop_privileges(...) run_unprivileged_work() else: continue_privileged_work()

Função primária

Security architecture

Propósito comunicativo

Reduce attack surface by isolating high-privilege code from the rest of the application.

Situações de gatilho

When a program needs to perform occasional privileged operations (e.g., opening low-numbered ports, modifying system files) while performing most work as an unprivileged user.

Contextos

Operating systems, network servers, daemon processes, applications that require root or admin rights for limited tasks.

Padrão

if process_has_privileges(): child_pid = fork() if child_pid == 0: drop_privileges(target_user) run_unprivileged_work() else: continue_privileged_work()

Estrutura central

if ...: child_pid = fork() if child_pid == 0: drop_privileges(...) run_unprivileged_work() else: continue_privileged_work()

Slots de substituição

target_user: username or UID to drop to; privileged_work: function or code block requiring elevated rights; unprivileged_work: function or code block that runs after dropping privileges.

Colocados típicos

fork
setuid
setgid
IPC mechanisms (UNIX sockets
pipes)
signal handling.

Substituições comuns

Using separate processes via execve
using capability-based systems (e.g.
Linux capabilities)
using containerization.

Erros comuns

Failing to drop privileges before performing untrusted work; leaking file descriptors with privileges retained; not checking return values of privilege‑dropping calls.

Similar / contraste

Sandboxing (e.g., seccomp, AppArmor) – restricts syscalls rather than splitting privileges; Principle of least privilege – broader concept; Privilege separation vs. privilege escalation – opposite.

Interferências

Coming from languages with automatic memory management (e.g., Java, Python): may assume dropping privileges is unnecessary because the language manages resources; forgetting that OS privileges are independent of language runtime.

Família do chunk

Sandboxing
Least privilege
Capability-based security
Containerization

Nuance

Must ensure that no privileged state (like open file descriptors or memory) is inherited by the unprivileged child; need to close privileged resources before dropping privileges.

Efeito pragmático

Limits the impact of vulnerabilities in the unprivileged part to non‑privileged operations, reducing the potential for system‑wide compromise.

Dica de memória

Split the crown: keep the king (privileged) in a guarded tower, send the peasant (unprivileged) to do the risky work.

Nota

Ensure that any file descriptors opened before dropping privileges are either closed or marked close‑on‑exec to prevent leakage into the unprivileged component.

Upgrade path

After mastering privilege separation, move to sandboxing techniques such as seccomp filters or full container isolation for stronger security guarantees.

Frequência: MediumFormulaicidade: Semi-fixedTipo de construção: conceptPrioridade de aquisição: Active recallPrioridade de output: BothTag de espaçamento: Medium-term

Examples

# Server binds to a low port then drops privileges import socket, os def start_server(): s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) s.bind(('', 80)) # privileged operation s.listen(5) pid = os.fork() if pid == 0: # child os.setuid(65534) # nobody while True: conn, addr = s.accept() handle(conn) else: os._exit(0) # parent exits def handle(conn): data = conn.recv(1024) conn.sendall(b'OK') start_server()

# Drop privileges before processing user upload import os, subprocess def process_upload(filepath): if os.getuid() == 0: os.setuid(65534) # nobody # now safe to handle untrusted file subprocess.run(['virus-scan', filepath], check=True) process_upload('/tmp/userfile')

# Daemon that opens a privileged socket then works unprivileged import socket, os def daemon_main(): sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) sock.bind(('', 443)) # needs root sock.listen(10) pid = os.fork() if pid == 0: os.setgid(65534) os.setuid(65534) while True: conn, _ = sock.accept() handle_connection(conn) else: os._exit(0) def handle_connection(conn): conn.sendall(b'Service ready') conn.close() daemon_main()