In information security, computer science, and other fields, the principle
of least privilege requires that in a particular abstraction layer of a
computing environment, every module must be able to access only the information
and resources that are necessary for its legitimate purpose.
Details The principle means giving a user
account only those privileges which are essential to that user's work. For
example, a backup user does not need to install software: hence, the backup user
has rights only to run backup and backup-related applications. Any other
privileges, such as installing new software, are blocked. The principle
applies also to a personal computer user who usually does work in a normal user
account, and opens a privileged, password protected account only when the
situation absolutely demands it. When applied to users, the terms least
user access or least-privileged user account are also used, referring to the
concept that all user accounts at all times should run with as few privileges
as possible, and also launch applications with as few privileges as
possible. Software bugs may be exposed when applications do not work correctly
without elevated privileges. The principle of least privilege is
widely recognized as an important design consideration in enhancing the
protection of data and functionality from faults and malicious behavior.
Benefits of the principle include: Better system stability. When code is
limited in the scope of changes it can make to a system, it is easier to test
its possible actions and interactions with other applications. In practice for
example, applications running with restricted rights will not have access
to perform operations that could crash a machine, or adversely affect other
applications running on the same system. Better system security. When code is
limited in the system-wide actions it may perform, vulnerabilities in one
application cannot be used to exploit the rest of the machine. For example,
Microsoft states “Running in standard user mode gives customers increased
protection against inadvertent system-level damage caused by "shatter
attacks" and malware, such as root kits, spyware, and undetectable viruses”.
Ease of deployment. In general, the fewer privileges an application requires
the easier it is to deploy within a larger environment. This usually results
from the first two benefits, applications that install device drivers
or require elevated security privileges typically have additional steps involved
in their deployment, for example on Windows a solution with no device
drivers can be run directly with no installation, while device drivers must
be installed separately using the Windows installer service in order to
grant the driver elevated privileges. In practice, true least privilege is
neither definable nor possible to enforce. Currently, there is no method
that allows evaluation of a process to define the least amount of privileges it
will need to perform its function. This is because it is not possible to know
all the values of variables it may process, addresses it will need, or the
precise time such things will be required. Currently, the closest
practical approach is to eliminate privileges that can be manually
evaluated as unnecessary. The resulting set of privileges still exceeds the true
minimum required privileges for the process.
Another limitation is the granularity of control that the operating environment
has over privileges for an individual process. In practice, it is rarely
possible to control a process's access to memory, processing time, I/O device
addresses or modes with the precision needed to facilitate only the precise
set of privileges a process will require.
History The original formulation is from Jerome
Saltzer: Every program and every privileged user
of the system should operate using the least amount of privilege necessary to
complete the job. Peter J. Denning, in his paper "Fault
Tolerant Operating Systems", set it in a broader perspective among four
fundamental principles of fault tolerance.
Dynamic assignments of privileges was earlier discussed by Roger Needham in
1972. Historically, the oldest instance of
least privilege is probably the source code of login.c, which begins execution
with super-user permissions and—the instant they are no longer
necessary—dismisses them via setuid() with a non-zero argument.
Implementation The kernel always runs with maximum
privileges since it is the operating system core and has hardware access. One
of the principal responsibilities of an operating system, particularly a
multi-user operating system, is management of the hardware's
availability and requests to access it from running processes. When the kernel
crashes, the mechanisms by which it maintains state also fail. Even if there
is a way for the CPU to recover without a hard reset, the code that resumes
execution is not always what it should be. Security continues to be enforced,
but the operating system cannot respond to the failure properly because
detection of the failure was not possible. This is because kernel
execution either halted or the program counter resumed execution from somewhere
in endless, and—usually—non-functional loop.
If execution picks up, after the crash, by loading and running trojan code, the
author of the trojan code can usurp control of all processes. The principle
of least privilege forces code to run with the lowest privilege/permission
level possible so that, in the event this occurs—or even if code execution
picks up from an unexpected location—what resumes the code execution
would not have the ability to perform malicious or undesirable things. One
method used to accomplish this can be implemented in the microprocessor
hardware. In the Intel x86 architecture, the manufacturer designed four running
"modes". As implemented in some operating
systems, processes execute with a potential privilege set and an active
privilege set. Such privilege sets are inherited from the parent as determined
by the semantics of fork(). An executable file that performs a
privileged function—thereby technically constituting a component of the TCB, and
concomitantly termed a trusted program or trusted process—may also be marked
with a set of privileges, a logical extension of the notions of set user ID
and set group ID. The inheritance of file privileges by a process are
determined by the semantics of the exec() family of system calls. The
precise manner in which potential process privileges, actual process
privileges, and file privileges interact can become complex. In practice, least
privilege is practiced by forcing a process to run with only those
privileges required by the task. Adherence to this model is quite complex
as well as error-prone. Similar principles
The Trusted Computer System Evaluation Criteria concept of trusted computing
base minimization is a far more stringent requirement that is only
applicable to the functionally strongest assurance classes, viz., B3 and A1.
Least privilege is often associated with privilege bracketing: that is, assuming
necessary privileges at the last possible moment and dismissing them as
soon as no longer strictly necessary, therefore ostensibly reducing fallout
from erroneous code that unintentionally exploits more privilege than is merited.
Least privilege has also been interpreted in the context of
distribution of discretionary access control permissions, for example
asserting that giving user U read/write access to file F violates least
privilege if U can complete his authorized tasks with only read
permission. See also
User Account Control Capability-based security
Compartmentalization Confused deputy problem
Encapsulation Need to know
Privilege bracketing Privilege escalation
Privilege revocation Privilege separation
setuid sudo
Notes References
External links Managing least privileges from the cloud
by Monique Sendze The Saltzer and Schroeder paper cited in
the references. NSA talks about the principle of least
privilege A discussion of the implementation of
the principle of least privilege in Solaris
Tom's IT Pro: Most Organizations Unaware of Employees With Admin Rights
"Proof that LUA makes you safer" by Dana Epp
Applying the Principle of Least Privilege to User Accounts on Windows
XP, by Microsoft Privilege Bracketing in the Solaris 10
Operating System, Sun Microsystems "Commercial enterprises are putting our
critical infrastructure at risk" CSO How to successfully implement the
principle of least privilege