Usercreation-policy

[Enrico Scholz]

johnsonm at redhat.com ("Michael K. Johnson") writes:

>> > I think too, that most daemons need both a dedicated user and a
>> > dedicated group.
> ...
> Actually, I'd like to point forward to SELinux for a possible solution.
> With SELinux, you can generally separate them effectively without having
> different users/groups.

IMO, this is not a very good solution since:

* people without SELinux kernels will get a very unsecure system, since
  their system would have lots of daemons which are running with the
  same uid
* within a SELinux context, you can need several helper-daemons
  (e.g. identd, or a monitoring-daemon) which would run with the
  same uid like the main-daemon and could access this daemon itself
  (kill(2), ptrace(2)) or its files.



Enrico