LinPEAS output makes sense once you know the concepts behind it. This dictionary explains each one — what it is, why LinPEAS checks it, what normal looks like, why it can be risky, how to verify it manually, and how to harden it.
Linux file permissions
Linux file permissions control who can read, write or execute a file, split across three classes: the owner, the group, and everyone else.
UID 0
UID 0 is the numeric user ID of root.
sudo and sudoers
sudo lets specified users run specified commands as another user (usually root), governed by /etc/sudoers.
SUID (set user ID)
SUID (set user ID) is a permission bit that makes an executable run with the privileges of its owner rather than the user who launched it.
SGID (set group ID)
SGID (set group ID) has two effects.
Linux capabilities
Linux capabilities break the all-or-nothing power of root into discrete units (like CAP_NET_RAW or CAP_SETUID) that can be granted to a binary without making it fully SUID-root.
cron jobs
cron runs commands on a schedule.
systemd services & timers
systemd manages services and, via timers, scheduled tasks.
PATH
PATH is the list of directories the shell searches for commands.
Environment variables
Environment variables configure processes — and sometimes leak secrets (API keys, passwords) or enable escalation.
AppArmor
AppArmor is a mandatory access control (MAC) system that confines individual programs to a set of allowed files, capabilities and operations defined in a profile.
SELinux
SELinux is a mandatory access control system (default on RHEL, CentOS, Fedora) that labels every process and object and enforces a policy on their interactions.
Linux namespaces
Linux namespaces isolate a process's view of system resources — process IDs, mount points, network interfaces, users and more.
Containers
A container is an isolated process (or group) using namespaces and cgroups to get its own view of the system while sharing the host kernel.