... and if you want to learn more than has been already said, start with the famous design of qmail as a collection of mutually untrusting daemons that run unde

... and if you want to learn more than has been already said, start with the famous design of qmail as a collection of mutually untrusting daemons that run under individual unprivileged user accounts, precisely to insulate each from the others using the normal operating system mechanisms that insulate one user's processes, files, directories, and so forth from another's. A good question to ask yourself: "Presume that my daemon is compromised by an attacker ... * ... what processes can it trace, debug, read/write the memory spaces and environments of, or send signals to?" * ... what files, devices, and directories can it read and write?" * ... what files, devices, and directories does it own, and can thus grant access to?" Then ask: "How does the answer change if instead of all of my daemons running as the same (even if unprivileged) user they each run as different users, some (where appropriate) having no write access to anything and owning no files nor directories at all?"