GID, current, primary, supplementary, effective and real group IDs?

Question

The following links discuss these concepts in different contexts. I have read their definitions, but I still can't tell how they are related, or if some of them are just the same.

• Current group ID
• GID
• Primary and supplementary group IDs
• Effective and real group IDs (also here)

Here is one example of the source of my confusion:

According to (4), If I type id, I should get what they call effective and real group IDs.

$ id uid=501(joe) gid=501(joe) groups=501(joe), 100(users)

However, this other link refers to the output of id to distinguish between primary and supplementary ids. Moreover, Wikipedia distinguishes between primary vs supplementary and effective vs real group ids. How do these concepts relate to each other?

Also, is it true that

• primary group id = GID = current group ID?

Answer 1

You mix two different distinctions here:

1. Between real and effective group ids
2. Between primary and supplementary users' groups

The first distinction refers to how processes are being run. Normally, when you run a command/program, it is run with the privileges of your user. It has the real group id same as your user's primary group. This can be changed by a process in order to preform some tasks as a member of another special group. To do that, programs use the setgid function that changes their effective group id.

The second distinction refers to users. Each user has his/her primary group. There is only one per user and is referred to as gid in the output of the id command. Apart from that, each user can belong to a number of supplementary groups - and these are listed at the end of id output.

[Edit] :

I agree that the manpage for id is somewhat misleading here. It is probably because it is a stripped-down version of the description provided by the info document. To see it more clearly, run info coreutils "id invocation" (as suggested at the end of the id manual).

Answer 2

The kernel view

Conceptually, there are three sets of groups that a process is a member of. Each set is a subset of the following one.

1. The single group that is the process's default group, which files created by this process will belong to.
2. The set of groups that are checked when the group requires permission to open a file.
3. The set of groups that a process running with extra privileges process can draw upon.

For historical reasons, these sets are respectively:

1. the effective group ID (egid);
2. the effective group ID plus the supplementary group IDs;
3. all of the above plus the real group ID and the saved set-group-ID.

Normally, a program has a single user ID. If the executable has the setuid mode bit set, then the program has two user IDs: its effective user ID is the one that matters for file permissions, per-user limits, determining whether the process is running as root and so on. The process can switch between the effective and the real user IDs, if it doesn't need its extra privileges all the time, or if it needs to switch between two non-root users.

The same mechanism exists for group. For groups, there is an additional feature which didn't exist when the system was designed: a process can be a member of any number of groups; these are the supplementary group IDs.

The user database view

Once a user is authenticated, the login process switches to that user, just before launching the user's shell (or whatever program the user requested). Just before switching to the desired user (and losing root privileges), the login process switches to the desired groups.

In early unix versions, a process could only be in a single group. This group is the user's primary group ID, stored in the user database (typically /etc/passwd). This group becomes the real and effective group ID of the shell or other program launched by the login process.

Nowadays, a process can be in multiple groups, so users can be in multiple groups, too. The group database (typically /etc/group) contains a list of users for each group. These groups become supplementary group IDs for the program launched by the login process.