# The 'kerberosd' user may switch to 'kerberosd-exec' to run untrusted code.
20131:20138
# The 'kerberosd-exec' user may not switch back to 'kerberosd' or anywhere else.
# Otherwise, compromised code could gain access to sensitive data like
# passwords or even switch to 'root'.
20138:20138