The primary aspect of avoiding excessive privilege on Linux and UNIX is not running processes under the superuser ("root", uid 0) account. Linux and some UNIX systems also provide additional mechanisms for reducing privilege.
On Linux and UNIX, the MFDS process (mfds32 or mfds64) typically runs as root, because it needs superuser permission to use its default port, 86. In recent releases of Enterprise Server, MFDS switches to the Default process user ID, if one is configured, shortly after startup. Micro Focus strongly recommends creating an account for Enterprise Server use and setting this as the default process user ID using the web administration interface or the casperm utility program.
Other daemon programs included with Enterprise Server generally do not need to run as root. Best practice is to configure these programs to run under a dedicated user account, which will let an administrator set filesystem permissions appropriately, as discussed in the topic Hardening filesystem permissions.
Avoid running other components of Enterprise Server or related products, such as the COBOL compiler, as root.
The user accounts used for Enterprise Server should not need access to elevation utilities such as sudo.
Linux distributions often include SELinux, a feature which permits restricting access to particular system calls and resources. Configuring SELinux is outside the scope of this document, but security-conscious organizations using Linux should investigate it.
Various UNIX-based operating systems have their own mechanisms for reducing privilege. For example, AIX and Solaris both have privilege mechanisms associated with their implementations of role-based access control (RBAC) which can be used to restrict the privileges available to particular processes.
Historically, the UNIX chroot system call was used to run some processes in a restricted environment. Modern UNIXes provide more effective OS virtualization mechanisms such as AIX WPARs and Solaris Containers (also known as "Zones"). Containerization with Docker is another way of constraining an enterprise server instance to a specific-purpose environment rather than having it run in an OS instance which is used for multiple purposes.