A Secure, Manifest-Based Framework for Delegated Privilege Promotion
This work addresses the security and operational conflict of maintaining privileged components in large-scale enterprise systems, providing a practical solution for automated patching without manual intervention.
The paper presents a secure, manifest-based framework for delegated privilege promotion that allows unprivileged processes to update privileged software components without full administrative rights. The system is deployed in production as part of a large-scale enterprise database system, mitigating TOCTOU attacks and enabling zero-downtime self-update.
Large-scale enterprise software systems commonly run as unprivileged service accounts to enforce least privilege, yet still depend on a small set of privileged components -- such as executables with elevated ownership, permissions, or capabilities -- for narrowly scoped operations. This creates a persistent security and operational conflict during maintenance. Automated patching tools running without elevated privileges cannot safely update privileged components without either executing the entire patch with full administrative rights or requiring manual administrator intervention. We present a secure, manifest-based infrastructure for delegated promotion of privileged software components, deployed in production as part of a large-scale enterprise database system serving both cloud and on-premises installations. The design centers on a minimal privileged mediator that validates cryptographically protected metadata and allows an unprivileged process to promote only vendor-approved files. The system explicitly mitigates Time-of-Check-to-Time-of-Use (TOCTOU) attacks using file-descriptor-bound validation and promotion, supports offline key rotation and revocation, and enables zero-downtime self-update via atomic replacement.