Every Process Runs as Someone
A program is not powerful by itself. It runs as a user, and it can do exactly what that user can do — no more, no less. That one fact is most of what "security" means on a running system.
I can see processes now and stop them. But what decides what a running program is actually allowed to do?
The same thing that decides what you are allowed to do. Every processProcessOne running program — a single instance of something the computer is doing right now, with its own identity and resources. runs as a user and inherits that user's permissionsPermissionsThe rules on each file saying who may read it, change it, or run it — split between its owner, its group, and everyone else.. A program has no power of its own — it borrows yours.
Which is the whole game. I do not need to defeat the operating system. I need you to run my program, and then it is simply you, doing everything you can.
A program borrows a user's power
When you launch a program, it runs as you: it can read every file you can read, change what you can change, and reach the network as you. ps even shows the user in its own column. The program is not trusted because of what it is — it is limited by whose authority it runs with.
$ ps -u
USER PID COMMAND
wren 2411 firefox # runs as you: your files, your power
root 988 systemd # runs as root: no limits at all
# a process can do exactly what its user can. that is the whole rule.
You download and run a small tool from a stranger, as your normal user. It was malicious. What can it do — without exploiting any bug at all?
Why "as whom" is the whole question
Run that same tool with sudosudo"Do this one command as the superuser" — a controlled, logged way to borrow administrator power for a single action rather than living with it. and it does not get your power — it gets root'srootThe all-powerful administrator account on a Unix system, allowed to do absolutely anything — including irreversible damage., which is unlimited. This is the concrete reason for the discipline from the permissions chapter: least privilege. Run everything as the least powerful user that works, and never hand a program root unless you have decided, deliberately, that it needs it.
A program you ran as your normal user turns out to be malware. Why can it read your personal files even though it never exploited a security flaw?
Ignoring whose power it runs with
- Running unknown programs as yourself without a second thought
- Reaching for `sudo` to make an error go away, handing root to whatever ran
- Assuming a program is safe because it is small or looks harmlessLeast privilege in practice
- Running things as the least powerful user that still does the job
- Giving [[sudo|sudo]] only to a command you have decided genuinely needs it
- Treating "what am I about to run, and as whom?" as a real questionMost compromises are not exotic exploits; they are ordinary programs, run by an ordinary user who trusted them, doing exactly what that user could do. The defence is the boring one: run less as more powerful accounts.
So a program is only ever as dangerous as the account it runs in.
Exactly — that is the sentence to keep. Powers belong to users; a process borrows them. Keep the borrowing small, and a bad program can only do a small amount of harm.
And every time someone runs something powerful without thinking, they lend me their whole account. I am rarely breaking in. I am usually just... invited.
Legal
Understanding process privilege protects your own systems. Persuading someone to run your program to gain their access — the attack this lesson describes — is unauthorised access and often serious crime; the point here is to recognise and refuse it, not to wield it.
So a process is only ever as powerful as the user it runs as, which makes "what am I running, and as whom?" one of the most important questions on the system. Next: controlling processes directly — starting them in the background, and stopping them gently or by force, on purpose.