The anwers above are rather wrong, because they assume that
nobody is a "generic" anonymous/guest style user id.
In the UNIX/Linux access control model anonymous/guest style user ids don't exist and these are bad suggestions:
- "common to run daemons as
nobody, especially servers, in order to limit the damage that could be done by a malicious user who gained control of them." because of the that follows: "However, the usefulness of this technique is reduced if more than one daemon is run like this, because then gaining control of one daemon would provide control of them all".
- "A real world example of this is
memcached (a key-value in-memory cache/database/thing), sitting on my computer and my server running under the
nobody account. Why? Because it just doesn't need any permissions and to give it an account that did have write access to files would just be a needless risk."
nobody user name with user id 65534 was created and reserved for a specific purpose and should be used only for that purpose: as a placeholder for "unmapped" users and user ids in NFS tree exports.
That is, unless user/id mapping is setup for NFS tree exports, all files in the export will appear owned by
nobody. The purpose of this is to prevent all users on the importing system from accessing those files (unless they have "other" permissions), as none of them (except
root) can be/become
Therefore it is a very bad idea to use
nobody for any other purpose, because its purpose is to be a user name/user id for files that must not be accessible to anybody.
The Wiki entry is very wrong too.
The UNIX/Linux practice is to create a new account for each "application" or application area that needs a separate access control domain, and to never reuse
nobody outside NFS.