Re: Filesystem Capabilities in 2.6?

[Michal Jaegermann]

On Sun, Nov 03, 2002 at 12:16:02AM -0700, Dax Kelson wrote:
> 
> Speaking of user 'nobody', modern best practices (and shipped vendor
> configuration) strongly discourages lumping everything under 'nobody'.
> 
> Each app should run in its own security context by itself.  That is why
> I have all the following users in my /etc/passwd:
> 
> apache nscd squid xfs ident rpc pcap nfsnobody radvd gdm named ntp

As a side issue each of these "users", or most of them, has likely also
its own group and one needs also few groups for other purposes.  Seems
like the next potential point to bump into a numbers of groups barrier
although probably most of these does not need to be shared.  Still if
this will become a part of a widely used security mechanisms there could
be extra demands on memberships.

  Michal