Controlling Privilege Escalation