Least privilege is the discipline of giving every process, user, and service only the permissions it needs—no more, no less. It is a core security control because it reduces the blast radius when something breaks or gets breached. Implementing it well requires precision. One wrong setting, and you either lock out critical functions or open a door attackers can walk through.
Manpages are the raw source of that precision. They are the canonical reference for command-line tools, syscalls, and configuration files. When you adopt a least privilege model, the manpages tell you exactly which flags change behavior, what permissions are required, and where the risks lie. For system administration, development, and security hardening, these pages are as important as the code they document.
Search, don't skim. Use man -k to locate commands and man with specific sections to narrow results. Security-relevant tools often hide critical details in option lists or environment variable sections. In manpages for chmod, setfacl, sudo, and capsh, every permission bit or capability flag matters. A single overlooked flag can defeat your policy.
Least privilege manpages work across user management, file permissions, kernel capabilities, and container isolation. Review the documentation for PAM modules before deploying, so you know exactly what each option enforces. Check the manpages for systemd unit files and namespaces to strip out unneeded privileges in service definitions. Read the Linux capabilities manpage (capabilities(7)) carefully—it is the blueprint for privilege separation at the kernel level.