2

How many primary groups can an individual Linux user have? If they can have more than one, how does one go about assigning multiple primary groups to a user? If it's just one, what's the cause?

1
  • I don't really know how to expand on this, so I won't add it as an answer and I'll just state it here: no, they cannot. Why? Well, uh, ask the designers of Unix I guess. – gardenhead Jan 24 '16 at 2:53
1

A user cannot have more than primary group. Why? Because the APIs used for accessing passwd data restrict it to one primary group. See man 3 getpwent:

The getpwent() function returns a pointer to a structure containing
the broken-out fields of a record from the password database (e.g.,
the local password file /etc/passwd, NIS, and LDAP).  The first time
getpwent() is called, it returns the first entry; thereafter, it
returns successive entries.

The passwd structure is defined in <pwd.h> as follows:

   struct passwd {
       char   *pw_name;       /* username */
       char   *pw_passwd;     /* user password */
       uid_t   pw_uid;        /* user ID */
       gid_t   pw_gid;        /* group ID */
       char   *pw_gecos;      /* user information */
       char   *pw_dir;        /* home directory */
       char   *pw_shell;      /* shell program */
   };

Note: gid_t pw_git. The standard says for pwd.h:

The <pwd.h> header shall define the struct passwd, structure, which shall include at least the following members:

char    *pw_name   User's login name. 
uid_t    pw_uid    Numerical user ID. 
gid_t    pw_gid    Numerical group ID. 
char    *pw_dir    Initial working directory. 
char    *pw_shell  Program to use as shell. 

The <pwd.h> header shall define the gid_t, uid_t, and size_t types as described in <sys/types.h>.

And in the page on types.h:

nlink_t, uid_t, gid_t, and id_t shall be integer types.

Thus, the standards restrict the primary group ID to be a single integer.

7
  • The question was about the Unix/Linux design, but your answer address the implementation. Yes, the current API allows only for one primary group, but this is due to the historical Unix design. If the Unix/Linux design supported multiple primary groups, then the API would certainly suit that design. – countermode Jan 25 '16 at 1:19
  • @countermode how did you read the design/implementation dichotomy from the two lines that compose the current question? O.o – muru Jan 25 '16 at 1:28
  • I admit it is an educated guess, but in my view the two questions are clearly about concepts & design. The very wording leaves no doubt to me. Personally I would find it quite odd if this question was about how to implement something. On top of that, if the question was on how to implement the assignment of multiple primary groups, then I think you rather needed to address the limitations of setgid and not of getpwent. – countermode Jan 25 '16 at 11:21
  • @countermode good for you. As for me, the question is neither about design nor about implementation, but about the state of the situation today. I can answer that using the spec as it is now, you answer it with handwaving about the past without any sources. I didn't say anything about how multiple primary groups would be implemented, so you really need to improve your reading skills. – muru Jan 25 '16 at 12:00
  • @muru Thanks. This answer explains why Linux users can't, as of now, have more than one primary group, and more importantly, what restricts us from adding more than one group for a user in the /etc/passwd. – Enkouyami Mar 14 '16 at 16:56
3

No, primary groups are unique, i.e. a user is assigned exactly one primary group. This is due to the Unix user and group concept. In the early days of Unix this was it, secondary groups were added much later. If the assignment of multiple groups had been there in the beginning of Unix development, there would likely no distinction between them. But as it is now, you are simply looking at Unix' heritage.

N.B. The distiction between primary and secondary groups has nothing to do with the format of /etc/passwd. If Unix/Linux supported multiple primary groups, then the format of /etc/passwd would surely reflect this. The way secondary groups are assigned through /etc/group is actually a crutch.

2

That is not possible on linux/unix, the primary group is the fourth field of the file /etc/passwd, which has a particular format:

username:*:userid:groupid:gecos:homedir:shell

The 4th field does not allow a list of integers.

Secondary group assignments are in /etc/group. There it is possible to list users on multiple groups.

6
  • Can you explain? I don't know what you mean by "linux alone" and what about the format of '/etc/passwd' is problematic. If I knew, I might not have asked my original question. – Enkouyami Jan 23 '16 at 2:05
  • You could store groups in Active Directory, or LDAP. If not then the info is on your linux box. Group membership is in the textfile /etc/groups, it has the name and gid of the group, and a list of members. The /etc/passwd textfile has a fixed number of fields, one of them has the gid that refers to one gid in /etc/group. Local users can view both files. man 5 passwd – bbaassssiiee Jan 23 '16 at 10:00
  • It would be great if you'd offered a full explanation of how and why your statements above proves your point, and how and why that point answers my questions. – Enkouyami Jan 23 '16 at 20:58
  • From your comment, I can't tell why storing groups in an active directory or LDAP is necessary and what that would accomplish; if by groups you mean the /etc/group and or /etc/passwd files; if one could just edit the field in /etc/passwd that refers a gid in /etc/group, to refer to more than one gid; and if that's only possible if those files aren't stored outside of linux. – Enkouyami Jan 23 '16 at 21:09
  • @Enkouyami "one could just edit the field in /etc/passwd that refers a gid in /etc/group, to refer to more than one gid" ... How do you imagine that would look? – muru Jan 23 '16 at 23:00
0

In earliest Unix, a user belonged to just one group, registered in the /etc/passwd file. This came from processes running with the privileges of one user and one group, the entry gave them for the shell started on login.

Later, users could belong to different groups (to get group-specific access privileges). There was a chgrp(1) command to change group, essentially starting a new shell with new user + group. The file /etc/group listed the groups a user could belong to (and passwords to change to the group, as applicable). The default group, recorded in /etc/passwd was called the primary group.

Newer Unix systems gained a a variety of databases to register user/password data, I will continue talking about /etc/passwd and /etc/group for simplicity, today the details vary with specific configuration. The format of the files has changed very little since the '80ies, and with them the general meanings of the various fields are set in stone. Unix APIs for accessing user data still depend on the layout of those files.

Even later, processes could belong to several groups at the same time. Thus the user's processes (starting from the login shell) belonged to several groups simultaneously, getting all groups the user can belong to from /etc/group.

From the previous discussion, in modern Unix systems a user can belong to one primary group only (by force of legacy file format), but the distinction between primary and secondary groups has all but disappeared.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.