Those are already unprivileged operations, but how does it start the initial process in that terminal with the correct privileges for a different user?
Those are already unprivileged operations, but how does it start the initial process in that terminal with the correct privileges for a different user?
The kernel could authenticate the user before starting it.
How does it do that?
There are many ways from passkeys to SAML. Though for complex methods we may want a dedicated services outside the kernel.