<!DOCTYPE html>
<html class="client-nojs vector-feature-night-mode-disabled vector-feature-language-in-header-enabled vector-feature-language-in-main-page-header-disabled vector-feature-page-tools-pinned-disabled vector-feature-toc-pinned-clientpref-1 vector-feature-main-menu-pinned-disabled vector-feature-limited-width-clientpref-1 vector-feature-limited-width-content-enabled vector-feature-custom-font-size-clientpref-1 vector-feature-appearance-pinned-clientpref-1 vector-sticky-header-enabled" lang="en" dir="ltr"><head>
<meta charset="UTF-8">
<title>Privilege revocation (computing)</title>
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<link rel="canonical" href="https://en.wikipedia.org/wiki/Privilege_revocation_(computing)"> <link href="./mw/skins.vector.icons.css" rel="stylesheet" type="text/css">
<link href="./mw/skins.vector.search.codex.styles.css" rel="stylesheet" type="text/css">
<link href="./mw/skins.vector.styles.css" rel="stylesheet" type="text/css">
<link href="./mw/user.styles.css" rel="stylesheet" type="text/css">
<meta name="ResourceLoaderDynamicStyles" content="">
<link rel="stylesheet" type="text/css" href="./mw/site.styles.css">
<link rel="stylesheet" type="text/css" href="./mw/noscript.css">
<link rel="stylesheet" type="text/css" href="./footer.css">
<link rel="stylesheet" type="text/css" href="./vector-2022.css">
</head>
<body class="skin--responsive skin-vector skin-vector-search-vue mediawiki ltr sitedir-ltr mw-hide-empty-elt ns-0 ns-subject page-Privilege_revocation_computing rootpage-Privilege_revocation_computing skin-vector-2022 action-view">
<div class="mw-page-container">
<div class="mw-page-container-inner">
<div class="mw-content-container">
<main id="content" class="mw-body">
<header class="mw-body-header vector-page-titlebar">
<h1 id="firstHeading" class="firstHeading mw-first-heading">
<span id="openzim-page-title" class="mw-page-title-main"><span class="mw-page-title-main">Privilege revocation (computing)</span></span>
</h1>
</header>
<a id="top"></a>
<div id="bodyContent" class="vector-body ve-init-mw-desktopArticleTarget-targetContainer" aria-labelledby="firstHeading" data-mw-ve-target-container="">
<div id="mw-content-text" class="mw-body-content mw-content-ltr" lang="en" dir="ltr"><div class="mw-content-ltr mw-parser-output" lang="en" dir="ltr"><style data-mw-deduplicate="TemplateStyles:r1236090951">
/* start https://en.wikipedia.org/ */
.mw-parser-output .hatnote{font-style:italic}.mw-parser-output div.hatnote{padding-left:1.6em;margin-bottom:0.5em}.mw-parser-output .hatnote i{font-style:normal}.mw-parser-output .hatnote+link+.hatnote{margin-top:-0.5em}@media print{body.ns-0 .mw-parser-output .hatnote{display:none!important}}
/* end https://en.wikipedia.org/ */
</style><div role="note" class="hatnote navigation-not-searchable">For the legal term, see <a href="Privilege_revocation_(law)" title="Privilege revocation (law)">Privilege revocation (law)</a>.</div>
<style data-mw-deduplicate="TemplateStyles:r1251242444">
/* start https://en.wikipedia.org/ */
.mw-parser-output .ambox{border:1px solid #a2a9b1;border-left:10px solid #36c;background-color:#fbfbfb;box-sizing:border-box}.mw-parser-output .ambox+link+.ambox,.mw-parser-output .ambox+link+style+.ambox,.mw-parser-output .ambox+link+link+.ambox,.mw-parser-output .ambox+.mw-empty-elt+link+.ambox,.mw-parser-output .ambox+.mw-empty-elt+link+style+.ambox,.mw-parser-output .ambox+.mw-empty-elt+link+link+.ambox{margin-top:-1px}html body.mediawiki .mw-parser-output .ambox.mbox-small-left{margin:4px 1em 4px 0;overflow:hidden;width:238px;border-collapse:collapse;font-size:88%;line-height:1.25em}.mw-parser-output .ambox-speedy{border-left:10px solid #b32424;background-color:#fee7e6}.mw-parser-output .ambox-delete{border-left:10px solid #b32424}.mw-parser-output .ambox-content{border-left:10px solid #f28500}.mw-parser-output .ambox-style{border-left:10px solid #fc3}.mw-parser-output .ambox-move{border-left:10px solid #9932cc}.mw-parser-output .ambox-protection{border-left:10px solid #a2a9b1}.mw-parser-output .ambox .mbox-text{border:none;padding:0.25em 0.5em;width:100%}.mw-parser-output .ambox .mbox-image{border:none;padding:2px 0 2px 0.5em;text-align:center}.mw-parser-output .ambox .mbox-imageright{border:none;padding:2px 0.5em 2px 0;text-align:center}.mw-parser-output .ambox .mbox-empty-cell{border:none;padding:0;width:1px}.mw-parser-output .ambox .mbox-image-div{width:52px}@media(min-width:720px){.mw-parser-output .ambox{margin:0 10%}}@media print{body.ns-0 .mw-parser-output .ambox{display:none!important}}
/* end https://en.wikipedia.org/ */
</style>
<p><b>Privilege revocation</b> is the act of an <a href="https://en.wiktionary.org/wiki/entity" class="extiw external" title="wikt:entity">entity</a> giving up some, or all of, the <a href="Privilege_(computing)" title="Privilege (computing)">privileges</a> they possess, or some <a href="Authority" title="Authority">authority</a> taking those (privileged) rights away.
</p>
<div class="mw-heading mw-heading2"><h2 id="Information_theory">Information theory</h2></div>
<p>Honoring the <a href="Principle_of_least_privilege" title="Principle of least privilege">Principle of least privilege</a> at a granularity provided by the base system such as <a href="Sandbox_(computer_security)" title="Sandbox (computer security)">sandboxing</a> of (to that point successful) attacks to an unprivileged user account helps in <a href="Reliability_engineering" title="Reliability engineering">reliability</a> of computing services provided by the system. As the chances of restarting such a process are better, and other services on the same machine aren't affected (or at least probably not as much as in the alternative case: i.e. a privileged process gone haywire instead).
</p>
<div class="mw-heading mw-heading2"><h2 id="Computer_security">Computer security</h2></div>
<p>In <a href="Computing_security" class="mw-redirect" title="Computing security">computing security</a> <i>privilege revocation</i> is a measure taken by a <a href="Computer_program" title="Computer program">program</a> to protect the <a href="System_software" title="System software">system</a> against misuse of itself.
</p><p>Privilege revocation is a variant of <a href="Privilege_separation" title="Privilege separation">privilege separation</a> whereby the program terminates the privileged part immediately after it has served its purpose. If a program doesn't revoke privileges, it risks the <a href="Privilege_escalation" title="Privilege escalation">escalation of privileges</a>.
</p><p>Revocation of privileges is a technique of <a href="Defensive_programming" title="Defensive programming">defensive programming</a>.
</p>
<div class="mw-heading mw-heading2"><h2 id="References">References</h2></div>
<ul><li><a rel="nofollow" class="external text" href="https://web.archive.org/web/20080827164311/http://www.cesg.gov.uk/products_services/iacs/cc_and_itsec/media/protection-profiles/authpp.pdf">Protection Profile for Privilege-Directed Content</a> Authoriszor Ltd, Ref: Auth_CC/PP/DES/01, Issue 1.3, 22 December 2000</li>
<li><a rel="nofollow" class="external text" href="http://alum.wpi.edu/~tfraser/Papers/timothy-fraser-2000-1.pdf">LOMAC: Low Water-Mark Integrity Protection for COTS Environments</a> by Timothy Fraser</li></ul></div><!--htdig_noindex--><div><div class="zim-footer">
This article is issued from <a class="external text" title="Last edited on 2024-01-08" href="https://en.wikipedia.org/wiki/?title=Privilege_revocation_(computing)&oldid=1194400005">Wikipedia</a>. The text is available under <a class="external text" href="https://creativecommons.org/licenses/by-sa/4.0/deed.en">Creative Commons Attribution-Share Alike 4.0</a> unless otherwise noted. Additional terms may apply for the media files.
</div>
</div><!--/htdig_noindex--></div>
</div>
</main>
</div>
</div>
</div>
</body></html>