Those are already unprivileged operations, but how does it start the initial process in that terminal with the correct privileges for a different user?
The kernel could authenticate the user before starting it.
The kernel could authenticate the user before starting it.