All about Unix groups and access control.
Under Unix each process and each resource belongs to a group. A group is internally represented by a group identifier (GID). The translation between group names and GIDs is stored in the file
/etc/group. This is a simple line-oriented database, where each record contains four fields: group name, group password, GID, and a comma-delimited list of users who have GID as secondary group (see below). The use of group passwords is discouraged. Following the pattern of
/etc/shadow an according file
/etc/gshadow was established.
The group membership of a process is stored in the file
/etc/passwd; this is also a line-oriented database where each record contains among other things the user name, the UID and the primary GID of the according user account. Unlike resources a process may belong to additional groups. These are stored in the fourth field of
/etc/group, i.e. a user belongs to each group for which his username is included in the fourth field of the according entry.
A typical entry in
/etc/group looks like this:
In this example the users
fred have the group
wheel as one of their secondary groups.
It is custom to reserve GIDs 0 to 99 for system groups and 100 to 499 or 999 to functional group accounts such as services, see
/etc/login.defs on Linux distributions that use the shadow suite. A special group is
wheel. If configured, only members of that group may use
su and do certain other things. Traditionally this group had GID 0 but it has become custom to assign this group GID 10.
Files and other resources can have only one group. The group membership of a file is stored in its inode.
The groups a process is in and the group a resource belongs to have influence on access control decisions. Suppose a process tries to access a resource: If
- the UID of the resource does not match the (effective) UID of the process
- the GID of the resource does match the (effective) GID or one of the secondary GIDs of the process
then the group access right of the resource apply.