@lispi314 @phnt @mia
> If your setup requires you not to trust the user, you shouldn't give the user access to things to start with.

Which is exactly what least privilege is about, you give specific permissions to system users (part of those being via groups, firewalls can also make use of user-separation).
Also I think you're thinking about human users, very different kind of concern, personally only very few people could ever get shell access to my machines, even a "restricted" kind.

> Programs should be limited by capabilities

Linux doesn't have proper capabilities, well except the ones that nearly made it into POSIX and are so deeply flawed it's not even funny as like half of them trivially allow to gain root privileges.