27

When going through Activity Monitor, I see many different users (other than my own account and the root account) responsible for individual processes. Why are the processes divided among many users that are created by the operating system? Why are they not simply divided amongst the root account and the user account currently in use?

Activity Monitor showing a list of various underscore-prefixed usernames beside processes.

4
  • 3
    I am not an expert so I cant give a full answer but parts of it is that you dont want every program or part of software to have full root access. – X_841 Jun 21 at 19:48
  • 12
    By the way, the term for these is service account (distinguished from a user account or admin account). – chrylis -cautiouslyoptimistic- Jun 22 at 4:36
  • 8
    This is normal in the Unix (MacOS, Solaris, BSD) and Linux world. Running a process as root allows anyone who hacks that process to execute code as root (because that process is already root) and running that process as yourself allow hackers to possibly access your files. – slebetman Jun 22 at 11:41
  • 3
    I think mentions of root/admin are misleading. The goal is that service accounts can't access files they aren't supposed to, such as your personal documents – Mooing Duck Jun 22 at 18:24
71

This is the principle of least privilege.

The principle means giving a user account or process only those privileges which are essential to perform its intended function. For example, a user account for the sole purpose of creating backups does not need to install software: hence, it has rights only to run backup and backup-related applications. Any other privileges, such as installing new software, are blocked.

https://en.wikipedia.org/wiki/Principle_of_least_privilege

Many daemons only need access to a specific hardware device or to specific files, so they run under a dedicated user account. This is done for security: that way, even if there's a bug or misconfiguration in one of these services, it can't lead to a full system attack, because the attacker will be limited to what this service can do and won't be able to overwrite files, spy on processes, etc.

https://unix.stackexchange.com/a/197155/45383

7
  • 1
    Fantastic answer, I would add that there are still plenty of instances where a service account has more privilege than any one of its processes strictly needs. But they're grouped to service accounts because out of 10 privileges needed for each process, 9 are shared, and theres one additional each process itself needs. Or similar. The principle of least privilege is almost always balanced with practical management of the software. Maybe not the case in OSX, I have no idea of the internals, but in most real world cases I have seen. – TCooper Jun 23 at 23:39
  • For example, is it possible to log in as a "virtual user" "_coreaudiod". So far I only know 2 users. Namely the user directory and root. Many Thanks – Darwin OS X Jun 24 at 8:36
  • @DarwinOSX Most service accounts cannot be used as login accounts (and on a system conforming to modern practices, the root account cannot login either). – Randall Jun 24 at 12:04
  • +1 A human example would be a large commercial building, hospital, airport, etc. Not every employee gets the same master key that opens every door, safe, lock, window, and utility room in the entire facility. People get keys that allow them to open only the doors they need in order to do their job. – J... Jun 24 at 14:42
  • @DarwinOSX specifically the login shell is likely disabled (shell is /dev/null or equivalent) so one cannot "login" per se, but one can act as the service user by using su and other UID changing tools. – crasic Jun 24 at 14:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .