Users

Overview

Linux is a multi-user operating system: many accounts can exist and operate on one system, each kept separate. The concept of a user is the foundation of Linux access control. This lesson explains what a user is and the crucial distinction between regular users and the superuser.

Learning objectives

• Define a Linux user account.
• Distinguish regular users from the root superuser.
• Explain how user identity drives access decisions.

Core concept

A user is an account that owns files and runs processes, identified internally by a numeric UID (user ID). Two broad categories matter:

• Regular users — everyday accounts (UIDs typically 1000+) with limited privileges, confined largely to their own files.
• root — the superuser (UID 0), with unrestricted control over the entire system.

Every process and file is associated with a user, and the kernel uses that identity to decide what is permitted.

How it works

When you log in, the system establishes your user identity (your UID and group memberships). From then on, actions you take are checked against that identity: you can read/write your own files, but the system blocks access to others' files or protected areas unless your identity permits it. The root user (UID 0) bypasses these checks — it can do essentially anything, which is what makes it both powerful and dangerous.

Practical example

The command whoami prints your current username, and id shows your UID, primary group, and group memberships:

$ whoami
alice
$ id
uid=1000(alice) gid=1000(alice) groups=1000(alice),27(sudo)

Here alice is UID 1000 (a regular user) who also belongs to the sudo group, meaning she can elevate privileges when needed — but is not root by default.

Cybersecurity relevance

User identity is the core of Linux security. The principle of least privilege says to operate as a regular user and only elevate to root when necessary, because a compromise of a root process compromises the whole system. Attackers seek privilege escalation — moving from a regular user (UID ≥ 1000) to root (UID 0). Understanding who a process runs as, and how identity gates access, is fundamental to both defending and testing Linux systems.

Common mistakes

• Working as root routinely instead of a regular user, magnifying the impact of any mistake or compromise.
• Confusing "admin group membership" with being root — being in sudo lets you elevate, it is not the same as running as root constantly.
• Ignoring which user a process runs as, which determines its access.

Key takeaways

• A user is an account identified by a numeric UID; regular users (UID ≥ 1000) have limited rights, while root (UID 0) has unrestricted control.
• The kernel checks every action against the acting user's identity; root bypasses those checks.
• Least privilege — staying a regular user and elevating only when needed — limits damage, and privilege escalation to root is a central attacker goal.

Check your understanding

• What UID does the root user have, and what makes root different from a regular user?
• Why does the principle of least privilege recommend against operating as root routinely?