When adding a user to a new group when does the user group permissions become active when its a /nologin user?

Question

I have a service level account to run my webserver, and this user is setup with /sbin/nologin.

Normally when you add a user to a group you must logout and login to use the new group permissions.

I'd like to add this user to another group to extend some of its permissions but since my webserver user never logs in, when or how will the user gain access to the new group permissions?

Answer 1

The process's groups are set by the program that changes from root to the target user before executing the process's program. When a user logs in, the program that changes the user is the login program (login, su, sshd, …) and the process's program is the user's shell. For a daemon run under system user, the program that changes the user can be su or some other tool such as Debian's start-stop-daemon. For example, start-stop-daemon always adds the supplemental groups to the process. The user-changing program must have logic to set both the primary group from the user database and the supplemental group from the group database.

Answer 2

With CentOS 6 nscd might be running. If you did not change the group ownership by a hig-level-command (like usermod) you have to make sure to run grpconv so /etc/gshadow gets updated as well. If nscd is running add nscd -i group to invalidate the local group cache. If you changed the primary GID run nscd -i passwd.

Check the result with id -a $ACCOUNT.

After that - restart your service.

Answer 3

I suggest su - ; /etc/init.d/NAME stop; /etc/init.d/NAME start;

"/etc/init.d/NAME restart" might be not enough.