What is privilege escalation and how is it prevented in Linux?
Published on 2026-10-20 by frfrand
Escalada de privilegios explicada de forma defensiva: permisos, servicios, actualizaciones y auditoría de accesos.
A privilege escalation occurs when an account or process obtains permissions higher than those it should have. In Linux it can mean going from a limited user to administrative capabilities or accessing resources that belong to another account.
It is an important topic because not all security problems start with full access. An attacker can first obtain reduced access and try to exploit errors to expand their control.
The hotel example
A guest receives a card that opens their room. That card should not allow entering other rooms, modifying reservations, or accessing the hotel's administration panel.
A privilege escalation is similar to making that card allow more than authorized. The problem is not always in the card: it can be in a defective lock, an employee who trusts too much, or a poorly defined policy.
On a server, those errors can correspond to file permissions, misconfigured services, or software vulnerabilities.
Normal users and root
Linux allows creating different accounts with separate permissions. The root account has broad administrative capabilities, so running the entire application with those privileges increases the consequences of a failure.
A web server that only needs to read certain files and listen on a configured port should not have unlimited access to the entire machine.
The principle of least privilege consists of granting what is necessary for a task, and nothing more.
What role does sudo play?
sudo allows authorized users to execute certain operations with elevated permissions. It is useful, but requires careful rules.
It is not a good idea to grant permissions for any command to a service account if it only needs to restart a specific process. It is also advisable to review which programs can be executed with special privileges.
Security is easily broken when someone thinks "just add administrator permissions and you're done" every time an access error occurs.
What are SUID and other mechanisms?
Linux has mechanisms to execute certain operations with specific capabilities or privilege contexts. They are necessary for different system functions, but an incorrect configuration can expand the attack surface.
In a defensive audit, it is advisable to review which programs really need those permissions and keep the packages that provide them updated. It is not necessary to turn that analysis into an exploitation guide to understand the risk.
An example with a web application
An API runs with an account that should only read its configuration and access a specific database. For convenience, someone changes the account so that it runs all processes as root.
If the application has a vulnerability, the potential damage increases enormously. Keeping the process under a limited user does not guarantee immunity, but it can reduce the scope of an incident.
It is also important not to store credentials for all clients in a place that any process can access.
How to reduce risk?
Apply security updates, separate service accounts, review file permissions, limit privileged commands, and use appropriate access controls.
In containers and VPSs, isolation, system capabilities, and host configurations must also be considered. An incorrectly isolated application can affect more resources than intended.
Additionally, record administrative changes and periodically check who retains access. Temporary permissions that no one revokes end up becoming permanent.
How to detect a dangerous configuration?
A defensive example consists of checking if an application uses the root account unnecessarily, if a sensitive directory can be modified by inappropriate users, or if an automation has overly broad credentials.
Not every elevated permission is a vulnerability: many legitimate operations require administration. The goal is for each capability to have a clear reason and proportionate controls.
And in ArduMaker?
When managing VPS, users, and applications from ArduMaker, it is advisable to maintain separation between administrative accesses and accounts used by each service. The infrastructure can facilitate that organization, but permission design remains the responsibility of those operating the projects.
To remember: privilege escalation means obtaining undue capabilities. Reducing privileges before an incident usually limits damage better than trying to correct it afterwards.
Sources: OWASP Least Privilege Principle · Linux capabilities.