When you invoke sudo, it prompts for password and then checks the /etc/sudoers configuration file to see if the user is permitted access to run the command. /etc/sudoers is the sudo configuration file that enables certain users or groups to run certain commands. For example, below we make the user called john, from any terminal, run the command power off:

john ALL= /sbin/poweroff

Obviously the root user can do anything:

root    ALL=(ALL) ALL

Since root can do anything, we often want to use the sudo program to elevate ourselves to root (with a password prompt) to perform some system level commands. If we enter the right password for our user, then we can perform the command. But we need a way to make sure this user can be elevated to root in the first place. Hence, the purpose of /etc/group.


/etc/group is a text file which defines the groups to which users belong. File system permissions are organized into user, group, and others. The use of groups allows additional abilities to be delegated in an organized fashion, such as access to disks, printers, and other peripherals.

When reading over this article of how to use gammu-smsd daemon, I came across this line:

We don't really want to enter our administration password every time we want to send SMS message, so first thing we must do is to add our selves to the dialout user group. All members of this group have permission to use modem-like devices on Ubuntu system.

And where is it defined that grants dialout group such privilege? I look in my /etc/sudoers file and I find no mention of dialout:

$ sudo cat /etc/sudoers
# /etc/sudoers
# This file MUST be edited with the 'visudo' command as root.
# See the man page for details on how to write a sudoers file.

Defaults    env_reset

# Host alias specification

# User alias specification

# Cmnd alias specification

# User privilege specification
root    ALL=(ALL) ALL

I think there is a key element I am missing about groups.


The Unix approach to groups that grant various sorts of access is quite primitive - it mostly just gives write (and possibly read) type permissions, to the relevant devices. So, for example, for dialout:

faheem@orwell:/dev$ ls -lah | grep dialout 
crw-rw---T 1 root dialout 4, 64 Jul 22 22:45 ttyS0 
crw-rw---T 1 root dialout 4, 65 Jul 22 22:45 ttyS1 
crw-rw---T 1 root dialout 4, 66 Jul 22 22:45 ttyS2 
crw-rw---T 1 root dialout 4, 67 Jul 22 22:45 ttyS3

So, the dialout group has permissions to write and read to the relevant devices; in this case, serial ports.


Some programs are written to check if the current user is in a specific group. If they are then it runs the application and if they are not then it prompts for an administrator password.

This has nothing to do with the sudoers file, but instead is a check performed at the code level of the software.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.