Пример: postfix.
При установке этой программы автоматом создается юзер postfix, причем, об этом информируется пользователь-установщик, создаются директории для почты, с правами postfix:mail, юзер постфикс конечно логинится в /bin/false и тд.
Само собой, все программы ставятся только из под рута, поэтому проблем с доступом к файлам нет. А вот ебилд постфикса:
# Copyright 1999-2008 Gentoo Foundation
# Distributed under the terms of the GNU General Public License v2
# $Header: /var/cvsroot/gentoo-x86/mail-mta/postfix/postfix-2.4.6-r2.ebuild,v 1.1 2008/02/03 11:43:08 ulm Exp $
# NOTE: this ebuild is a regular ebuild without mailer-config support!
# Comment lines below "regular ebuild" and uncomment lines below "mailer-config support"
# to turn this ebuild to a mailer-config enabled ebuild.
# regular ebuild
inherit eutils multilib ssl-cert toolchain-funcs flag-o-matic pam
# mailer-config support
#inherit eutils multilib ssl-cert toolchain-funcs flag-o-matic mailer pam
KEYWORDS="~alpha ~amd64 ~arm ~hppa ~ia64 ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~x86-fbsd"
# regular ebuild
IUSE="cdb dovecot-sasl hardened ipv6 ldap mailwrapper mbox mysql nis pam postgres sasl selinux ssl vda"
# mailer-config support
#IUSE="cdb dovecot-sasl hardened ipv6 ldap mbox mysql nis pam postgres sasl selinux ssl vda"
MY_PV="${PV/_rc/-RC}"
MY_SRC="${PN}-${MY_PV}"
MY_URI="ftp://ftp.porcupine.org/mirrors/postfix-release/official"
VDA_P="${P}-vda-ng-r2"
RC_VER="2.2.9"
DESCRIPTION="A fast and secure drop-in replacement for sendmail."
HOMEPAGE="http://www.postfix.org/"
SRC_URI="${MY_URI}/${MY_SRC}.tar.gz
vda? ( http://gentoo.longitekk.com/${VDA_P}.patch.gz ) "
LICENSE="IPL-1"
SLOT="0"
# regular ebuild
PROVIDE="virtual/mta virtual/mda"
# mailer-config support
#PROVIDE="${PROVIDE} virtual/mda"
DEPEND=">=sys-libs/db-3.2
>=dev-libs/libpcre-3.4
cdb? ( || ( >=dev-db/cdb-0.75-r1 >=dev-db/tinycdb-0.76 ) )
ldap? ( >=net-nds/openldap-1.2 )
mysql? ( virtual/mysql )
pam? ( virtual/pam )
postgres? ( >=dev-db/postgresql-7.1 )
sasl? ( >=dev-libs/cyrus-sasl-2 )
ssl? ( >=dev-libs/openssl-0.9.6g )"
# regular ebuild
RDEPEND="${DEPEND}
>=net-mail/mailbase-0.00
!mailwrapper? ( !virtual/mta )
mailwrapper? ( >=net-mail/mailwrapper-0.2 )
selinux? ( sec-policy/selinux-postfix )"
# mailer-config support
#RDEPEND="${DEPEND}
# >=net-mail/mailbase-0.00
# selinux? ( sec-policy/selinux-postfix )"
S="${WORKDIR}/${MY_SRC}"
group_user_check() {
einfo "Checking for postfix group ..."
enewgroup postfix 207
einfo "Checking for postdrop group ..."
enewgroup postdrop 208
einfo "Checking for postfix user ..."
enewuser postfix 207 -1 /var/spool/postfix postfix,mail
}
pkg_setup() {
# Do not upgrade live from Postfix <2.4
if [[ -f /var/lib/init.d/started/postfix ]] ; then
if has_version '<mail-mta/postfix-2.4.0' ; then
if [[ "${FORCE_UPGRADE}" ]] ; then
echo
ewarn "You are upgrading from an incompatible version and you have"
ewarn "FORCE_UPGRADE set, will build this package while Postfix is running."
ewarn "You MUST stop Postfix BEFORE installing this version to your system."
echo
else
echo
eerror "You are upgrading from an incompatible version."
eerror "You MUST stop Postfix BEFORE installing this version to your system."
eerror "If you want minimal downtime, emerge postfix with:"
eerror " FORCE_UPGRADE=1 emerge --buildpkgonly postfix"
eerror " /etc/init.d/postfix stop"
eerror " emerge --usepkgonly postfix"
eerror "Then run etc-update or dispatch-conf and merge the configuration files."
eerror "Then restart Postfix with: /etc/init.d/postfix start"
die "Upgrade from an incompatible version!"
echo
fi
else
echo
ewarn "It's safe to upgrade your current version while it's running."
ewarn "If you don't want to take any chance, please hit Ctrl+C now,"
ewarn "stop Postfix, then emerge again."
ewarn "You have been warned!"
ewarn "Waiting 5 seconds before continuing ..."
echo
epause 5
fi
fi
echo
ewarn "Read \"ftp://ftp.porcupine.org/mirrors/postfix-release/official/${MY_SRC}.RELEASE_NOTES\""
ewarn "for incompatible changes before continueing."
ewarn "Bugs should be filed at \"http://bugs.gentoo.org/\" and"
ewarn "assigned to \"net-mail@gentoo.org\"."
echo
# Warnings to work around bug #45764
if has_version '<=mail-mta/postfix-2.0.18' ; then
echo
ewarn "You are upgrading from postfix-2.0.18 or earlier, some of the empty queue"
ewarn "directories get deleted while unmerging the older version (see bug #45764)."
ewarn "Please run '/etc/postfix/post-install upgrade-source' to recreate them."
echo
fi
....ну и так далее
Как видишь, все прозрачно.
Свежеустановленная винда с ее включенным по дефолту пользователем lksjdlfk (уж не помню точно, извините) - само собой в плане безопасности куда круче.