All about Unix groups and access control.

Under Unix each process and each resource belongs to a group. A group is internally represented by a group identifier (GID). The translation between group names and GIDs is stored in the file /etc/group. This is a simple line-oriented database, where each record contains four fields: group name, group password, GID, and a comma-delimited list of users who have GID as secondary group (see below). The use of group passwords is discouraged. Following the pattern of /etc/passwd and /etc/shadow an according file /etc/gshadow was established.

The group membership of a process is stored in the file /etc/passwd; this is also a line-oriented database where each record contains among other things the user name, the UID and the primary GID of the according user account. Unlike resources a process may belong to additional groups. These are stored in the fourth field of /etc/group, i.e. a user belongs to each group for which his username is included in the fourth field of the according entry.

A typical entry in /etc/group looks like this:


In this example the users root, joe, and fred have the group wheel as one of their secondary groups.

It is custom to reserve GIDs 0 to 99 for system groups and 100 to 499 or 999 to functional group accounts such as services, see /etc/login.defs on Linux distributions that use the shadow suite. A special group is wheel. If configured, only members of that group may use su and do certain other things. Traditionally this group had GID 0 but it has become custom to assign this group GID 10.

Files and other resources can have only one group. The group membership of a file is stored in its inode.

The groups a process is in and the group a resource belongs to have influence on access control decisions. Suppose a process tries to access a resource: If

  • the UID of the resource does not match the (effective) UID of the process
  • the GID of the resource does match the (effective) GID or one of the secondary GIDs of the process

then the group access right of the resource apply.

history | excerpt history