Ownership of files in var being changed without my knowledge.

[EngineerStrange]

But what is happening with me is unusual and as you said "The user account nobody is sometimes used by processes that voluntarily drop their user priviledges so they can't do damage even if they get compromised"- is this because something wrong has entered in my system or what?

[scorp123]

But what is happening with me is unusual and as you said "The user account nobody is sometimes used by processes that voluntarily drop their user priviledges so they can't do damage even if they get compromised"- is this because something wrong has entered in my system or what?

No. It's standard procedure. A safety measure out of the box. Many processes, services and programs will drop all priviledges when they don't need them and then make use of "nobody".

There used to be a time (1980's) when everything on Unix (the spiritual ancestor of Linux) was running as "root" and every service that was available on the system was turned on by default. Many of those network services have completely fallen out of use exactly because they turned out to be such security nightmares and had more holes than a Swiss cheese, e.g. telnet, rsh, rlogin, rcp, finger, ftp, many others.

Back then Unix viruses such as the legendary "Morris Worm" were a thing.

Developers soon realised that running programs and services with way too many priviledges was a bad thing and most of the time is totally not necessary. Turning every available service on a system on per default was seen as a horribly bad idea too. So this all changed.

The solution was the invention of the "nobody" account and implementing processes and services in such a way that they would drop their rights to "root" and become "nobody" whenever they can. And all these unsafe services were either abolished completely or replaced with massively safer and encrypted alternatives such as SSH (which replaces rsh, rlogin, rcp, ftp and telnet ...).

When Linux was created in the early 1990's it adopted those changes too and that's where we are at today.