 To reduce the risk of a vulnerability or <unk> allowing privilege escalation , many programs have been written or adapted to make use of privilege separation , privilege revocation and <unk> . Privilege separation is a technique , pioneered on OpenBSD and inspired by the principle of least privilege , where a program is split into two or more parts , one of which performs privileged operations and the other — almost always the bulk of the code — runs without privilege . Privilege revocation is similar and involves a program performing any necessary operations with the privileges it starts with then dropping them . <unk> involves restricting an application to one section of the file system , prohibiting it from accessing areas that contain private or system files . Developers have applied these features to OpenBSD versions of many common applications , such as <unk> , file , <unk> , <unk> , and <unk> . 
