 To reduce the risk of a vulnerability or misconfiguration allowing privilege escalation , many programs have been written or adapted to make use of privilege separation , privilege revocation and chrooting . Privilege separation is a technique , pioneered on OpenBSD and inspired by the principle of least privilege , where a program is split into two or more parts , one of which performs privileged operations and the other — almost always the bulk of the code — runs without privilege . Privilege revocation is similar and involves a program performing any necessary operations with the privileges it starts with then dropping them . Chrooting involves restricting an application to one section of the file system , prohibiting it from accessing areas that contain private or system files . Developers have applied these features to OpenBSD versions of many common applications , such as tcpdump , file , tmux , smtpd , and syslogd . 
