I've noticed that after uninstalling the postgresql
package in ArchLinux the postgres
user and group are not removed automatically. The same is true for some other packages. Investigating this further, I've come across this page, which states:
The packages listed here use
userdel
/groupdel
to remove the user they created. These should never be removed automatically as it poses a security risk if any files are left behind with this ownership.
I wonder why leaving files with this ownership poses a security risk?