Granting access rights by the principle of least privilege

What it is

The principle of least privilege requires that an account or process have exactly the rights its task requires, not the ones that would be convenient. Linux offers finer tools for this than "root or not root": capabilities split the superuser's rights into individual abilities. CAP_NET_BIND_SERVICE, for example, allows binding to ports below 1024 and nothing else. In PostgreSQL, GRANT assigns rights per object and action (such as SELECT, INSERT, UPDATE, DELETE) to roles, and roles can be members of other roles, so rights are bundled rather than handed out one by one.

Why it matters

The damage from a mistake or a break-in is limited by the rights of the affected identity. A web service whose role may only read and write to two tables cannot drop the schema in the event of an SQL injection. A script running as a normal user cannot wipe the root directory because of a typo. For automated agents this applies twice over: they carry out instructions whose origin they cannot always judge, and their rights are the upper limit of the possible damage.

How to apply

• Use a separate identity per service and environment: its own database role, its own API key, its own system user; never a shared "app" account for everything.
• Derive rights from the task and write them down: which tables, which actions, which directories, which network destinations? Nothing else is granted. Migrations run with a separate role in a separate step.
• Start processes without root; where a root-level right is needed, grant only the individual capability and drop the rest.
• For humans: a default account without special rights, elevation only for a limited time and logged, and administration accounts kept separate from the everyday account.
• Deny by default: new resources are unreachable for everyone until someone adds a right, not the other way round.
• Clean up regularly: revoke rights that have not been used for a long time; remove departed people and decommissioned services the same day.

Pitfalls

Rights accumulate: every incident fix adds one, and nobody takes it back. Catch-all roles such as "developer" with production access. The service has few rights, but its deployment token is an administrator. Read access is considered harmless, even though it exposes personal data and secrets. Least privilege limits the misuse of rights that belong to someone else, not the misuse of one's own legitimate rights; that requires logging and the four-eyes principle.