Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

As far as I understand the users in Unix system can belong to multiple groups and one of them will become the primary group for that user. Others will be supplementary groups. All of this User/Group infrastructure is facilitated by /etc/group and /etc/passwd files.

Now group permission of the user is determined exclusively by the active group which can be changed by newgrp command. The active group on login is the primary group defined in /etc/passwd file. So the question is what is the fundamental reason on why the designers chose to have this concept of a single active group even though allowing the user to have more than one supplementary groups? What would be the issue if all the groups were active simultaneously?

share|improve this question

3 Answers 3

All groups are active at all times.

You can access any file that any of your groups can access. But when you create a new file/process it is created using your primary group, unless setgid or ACL defaults are in use.

share|improve this answer

One reason: when one creates a file, it can be only in one group, and this group is not specified during the file creation. So, there must be a notion of single active group.

share|improve this answer

Q1: So the question is what is the fundamental reason on why the designers chose to have this concept of a single active group even though allowing the user to have more than one supplementary groups?

The original primary purpose of groups in Unix was to allow for sharing of access to files on disks. Within this use case you'd typically be accessing your files the majority of the time, and occasionally be accessing files that were shared among a group of users.

So my suspicion is that it was designed around this model to start. Over time this model has been modified, but the general approach remains intact, that you're in a primary group (specified in /etc/passwd) and you have supplementary groups that you can be a member of (specified in /etc/group).

Several of the earlier implementations (such as on Sun/Solaris) included a limit of ~15 groups total that a user could be a member of when using NIS+.

Q2: What would be the issue if all the groups were active simultaneously?

There are a number of system calls within POSIX that expose an API with this design, hence it would probably be a large task to modify it, given the amount of software that's built around it at this point. And there really isn't any reason to change it either.

The other big limitations are the file system and process space. For filesystems, these generally include only a single value for the GID that a given file or directory is to be "grouped" to. Same too for processes that are running. They're typically associated to a single group.

However, this overall approach has been able to adapt to being integrated with Active Directory and other credential technologies over time, so it's a perfectly fine implementation, though a little strange when you first learn about it.

References

= OpenGroup POSIX docs mentioning GID

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.