I've been Googling all over trying to find an answer to this, and trying to mentally parse initialization scripts to find where it's done, to no avail.
I just did a
ps and pulled a random example. I have a process that appears as follows:
polkitd 1230 1 0 May07 ? 00:00:00 /usr/lib/polkit-1/polkitd --no-debug
looking at my /etc/passwd, I see:
polkitd:x:87:87:PolicyKit daemon owner:/var/lib/polkit:/bin/false
As a test, I run a command as root:
# su - polkitd -c whoami
Which returns no output, as expected due to it having /bin/false as a shell. Additionally,
# su - polkitd does not switch me to polkitd. To make sure I was doing this correctly, I tested both of these with a normal user account and both worked as they should.
So, how is it that a dedicated account such as polkitd in my example can be made to run a process, when you seemingly can't make it run anything at all manually?