A Secure, Manifest-Based Framework for Delegated Privilege Promotion

Computer Science > Cryptography and Security [Submitted on 27 May 2026] A Secure, Manifest-Based Framework for Delegated Privilege Promotion Rajarshi Chowdhury, Akshay Shah Large-scale enterprise software systems commonly run as unprivileged service accounts to enforce least privilege, yet still depend on a small set of privileged components -- such as executables with elevated ownership, permissions, or capabilities -- for narrowly scoped operations. This creates a persistent security and operational conflict during maintenance. Automated patching tools running without elevated privileges cannot safely update privileged components without either executing the entire patch with full administrative rights or requiring manual administrator intervention. We present a secure, manifest-based infrastructure for delegated promotion of privileged software components, deployed in production as part of a large-scale enterprise database system serving both cloud and on-premises installations. The design centers on a minimal privileged mediator that validates cryptographically protected metadata and allows an unprivileged process to promote only vendor-approved files. The system explicitly mitigates Time-of-Check-to-Time-of-Use (TOCTOU) attacks using file-descriptor-bound validation and promotion, supports offline key rotation and revocation, and enables zero-downtime self-update via atomic replacement. Comments: Accepted at the 56th Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN 2026). 7 pages, 6 figures Subjects: Cryptography and Security (cs.CR); Operating Systems (cs.OS) ACM classes: D.4.6; K.6.5; D.2.7 Cite as: arXiv:2605.28991 [cs.CR]   (or arXiv:2605.28991v1 [cs.CR] for this version)   https://doi.org/10.48550/arXiv.2605.28991 Focus to learn more Submission history From: Rajarshi Chowdhury [view email] [v1] Wed, 27 May 2026 18:48:47 UTC (383 KB) Access Paper: HTML (experimental) view license Current browse context: cs.CR < prev   |   next > new | recent | 2026-05 Change to browse by: cs cs.OS References & Citations NASA ADS Google Scholar Semantic Scholar Export BibTeX Citation Bookmark Bibliographic Tools Bibliographic and Citation Tools Bibliographic Explorer Toggle Bibliographic Explorer (What is the Explorer?) Connected Papers Toggle Connected Papers (What is Connected Papers?) Litmaps Toggle Litmaps (What is Litmaps?) scite.ai Toggle scite Smart Citations (What are Smart Citations?) Code, Data, Media Demos Related Papers About arXivLabs Which authors of this paper are endorsers? | Disable MathJax (What is MathJax?)