On Wed, Apr 06, 2005 at 12:37:52PM -0400, Jim Wise wrote:
> If the goal is to ensure that someone who compromises pflogd does not 
> get access to useful services, it should run as nobody or as daemon.

It would still allow the pflogd to ptrace other processes running under
the same UID.

Joerg