Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I changed permissions of a file (chmod g+w testfile) and running ls -l testfile gives:

-rwxrwxr-x 1 user1 user1 0 2011-01-24 20:36 testfile

I then added a user to that group ("/etc/group" has user1:x:1000:user2 line), but am failing to edit that file as user2. Why is this so?

share|improve this question

2 Answers 2

up vote 8 down vote accepted

user2 needs to log out and back in. Group permissions work this way:

  • When you log in, your processes get to have group membership in in your main group mentioned in /etc/passwd, plus all the groups where your user is mentioned in /etc/group. (More precisely, the pw_gid field in getpw(your_uid), plus all the groups of which your user is an explicit member. Beyond /etc/passwd and /etc/group, the information may come from other kinds of user databases such as NIS or LDAP.) The main group becomes the process's effective group ID and the other groups become its supplementary group IDs.
  • When a process performs an operation that requires membership in a certain group, such as accessing a file, that group must be either the effective group ID or one of the supplementary group IDs of the process.

As you can see, your change to the user's group membership only takes effect when the user logs in. For running processes, it's too late. So the user needs to log out and back in. If that's too much trouble, the user can log in to a separate session (e.g. on a different console, or with ssh localhost).

Under the hood, a process can only ever lose privileges (user IDs, group IDs, capabilities). The kernel starts the init process (the first process after boot) running as root, and every process is ultimately descended from that process¹. The login process (or sshd, or the part of your desktop manager that logs you in) is still running as root. Part of its job is to drop the root privileges and switch to the proper user and groups.

There's one single exception: executing a setuid or setgid program. That program receives additional permissions: it can choose to act under various subsets of the parent process's memberships plus the additional membership in the user or group that owns the setxid executable. In particular, a setuid root program has root permissions, hence can do everything²; this is how programs like su and sudo can do their job.

¹ There are occasionally processes that aren't derived from init (initrd, udev) but the principle is the same: start as root and lose privileges over time.
² Barring multilevel security frameworks such as SELinux.

share|improve this answer
    
Note that if you're using a desktop GUI, simply logging out and back in to a terminal window will not reset group membership. I had this problem and I need to log out of my GUI session also :þ –  user394 Jul 14 at 14:15
    
@user394 Logging out and back in does reset group membership. If you merely close a terminal window, you aren't logging out. –  Gilles Jul 14 at 14:23

You might need to have user2 log out and back in (or just try ssh'ing in to create a new login session). Check the output of id --groups to show the numeric group ids for a user.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.