Hacker News new | ask | show | jobs
by userbinator 1138 days ago
Alternatively, perhaps we should start thinking about whether it is a good idea to have multiple users of different privilege sharing the same hardware.
3 comments

"User" in a modern Linux system is just a weird name for "security domain". Many programs run as their own user to limit their ability to attack the rest of the system if they get compromised; and limit the ability of a different compromised component from attacking them.

My desktop, on which I am the only person with an account, has 49 "users", of which 11 are actively running a process.

At work, every daemon we run has a dedicated user.

On android, every app runs as its own user.

What's the alternative, just running all code at ring 0?
IMHO rings 0 + 3 with protections against bugs, and not deliberate malice, is probably the sweet spot.
I’ve been thinking this recently as well.