Why does ArchLinux keep some users/groups after package uninstallation?

Question

I've noticed that after uninstalling the postgresql package in ArchLinux the postgres user and group are not removed automatically. The same is true for some other packages. Investigating this further, I've come across this page, which states:

The packages listed here use userdel/groupdel to remove the user they created. These should never be removed automatically as it poses a security risk if any files are left behind with this ownership.

I wonder why leaving files with this ownership poses a security risk?

Answer 1

This is a security risk because file ownership in the FS is stored not by symbolic name, but by UID and GID. If a user is removed and files remain owned by that user, they become inaccessible under owner permission. However, if a different user is later created that is allocated the same UID, that user will gain ownership of the files. This is potentially a security risk because of the various ways in which file ownership is used as a security mechanism; the simplest form is that where confidential information (e.g. SSH keys in id_rsa and so forth, wi-fi authentication information in wpa_supplicant.conf) could be leaked to the new user.