Linux
What is Least privilege?
Giving each user, process, and service only the access it needs to do its job — nothing more — to limit damage if any one is compromised.
How it works
If everything runs as root, one compromised app owns the whole machine. Least privilege contains the blast radius: a hacked web server can't read your keys if it never had permission to.
Example
In practiceA service runs as its own unprivileged user that can write only to its own directory, not your home folder or system files.
How do I apply least privilege?
Run services as dedicated non-root users, scope sudo to specific commands, and use AppArmor to confine what each app can touch.
Go deeper: Build a Hardened Linux Workstation
The complete, step-by-step guide — every command, config, and the reasoning behind it.
Get the guide