See
Linux 16 - Local Security Principles on Linux