Could you describe what the &quot;group&quot; gets eaten by? In most cases I&#x27;ve seen, the group works well as a permission set - e.g. &quot;dialout&quot; is for all users allowed to use the dialer, &quot;lp&quot; for all those allowed to use the printer, &quot;audio&quot; for those allowed to use the speaker, etc.<p>Indeed, some pieces of software insist that the service user actually do everything, which is still supported with this model if the binaries are setuid with +x on owner and group but not other -- although, as you pointed out, auditing tends to suffer in this case.<p>Speaking of which -- what&#x27;s your favorite auditing setup? I need to set one up soon, I&#x27;ve been using auditd but it feels cumbersome.