> The problem is every executable can impersonate the user,
Um, what?
What do you mean by "impersonate" here? What does a process that does not impersonate the user look like? Do you just mean "executables that run as the user"?
When you log in, and a shell is started that runs as you, is that shell impersonating the user?
When you execute commands, as yourself, those commands run with your credentials. Because you ran them. Isn't that, like, the point?
Um, what?
What do you mean by "impersonate" here? What does a process that does not impersonate the user look like? Do you just mean "executables that run as the user"?
When you log in, and a shell is started that runs as you, is that shell impersonating the user?
When you execute commands, as yourself, those commands run with your credentials. Because you ran them. Isn't that, like, the point?