Can a Linux user have multiple primary user groups?

Question

How many primary groups can an individual Linux user have? If they can have more than one, how does one go about assigning multiple primary groups to a user? If it's just one, what's the cause?

Answer 1

No, primary groups are unique, i.e. a user is assigned exactly one primary group. This is due to the Unix user and group concept. In the early days of Unix this was it, secondary groups were added much later. If the assignment of multiple groups had been there in the beginning of Unix development, there would likely no distinction between them. But as it is now, you are simply looking at Unix' heritage.

N.B. The distiction between primary and secondary groups has nothing to do with the format of /etc/passwd. If Unix/Linux supported multiple primary groups, then the format of /etc/passwd would surely reflect this. The way secondary groups are assigned through /etc/group is actually a crutch.

Answer 2

That is not possible on linux/unix, the primary group is the fourth field of the file /etc/passwd, which has a particular format:

username:*:userid:groupid:gecos:homedir:shell

The 4th field does not allow a list of integers.

Secondary group assignments are in /etc/group. There it is possible to list users on multiple groups.

Answer 3

A user cannot have more than primary group. Why? Because the APIs used for accessing passwd data restrict it to one primary group. See man 3 getpwent:

The getpwent() function returns a pointer to a structure containing
the broken-out fields of a record from the password database (e.g.,
the local password file /etc/passwd, NIS, and LDAP).  The first time
getpwent() is called, it returns the first entry; thereafter, it
returns successive entries.

The passwd structure is defined in <pwd.h> as follows:

   struct passwd {
       char   *pw_name;       /* username */
       char   *pw_passwd;     /* user password */
       uid_t   pw_uid;        /* user ID */
       gid_t   pw_gid;        /* group ID */
       char   *pw_gecos;      /* user information */
       char   *pw_dir;        /* home directory */
       char   *pw_shell;      /* shell program */
   };

Note: gid_t pw_git. The standard says for pwd.h:

The <pwd.h> header shall define the struct passwd, structure, which shall include at least the following members:

char    *pw_name   User's login name. 
uid_t    pw_uid    Numerical user ID. 
gid_t    pw_gid    Numerical group ID. 
char    *pw_dir    Initial working directory. 
char    *pw_shell  Program to use as shell. 

The <pwd.h> header shall define the gid_t, uid_t, and size_t types as described in <sys/types.h>.

And in the page on types.h:

nlink_t, uid_t, gid_t, and id_t shall be integer types.

Thus, the standards restrict the primary group ID to be a single integer.

Answer 4

In earliest Unix, a user belonged to just one group, registered in the /etc/passwd file. This came from processes running with the privileges of one user and one group, the entry gave them for the shell started on login.

Later, users could belong to different groups (to get group-specific access privileges). There was a chgrp(1) command to change group, essentially starting a new shell with new user + group. The file /etc/group listed the groups a user could belong to (and passwords to change to the group, as applicable). The default group, recorded in /etc/passwd was called the primary group.

Newer Unix systems gained a a variety of databases to register user/password data, I will continue talking about /etc/passwd and /etc/group for simplicity, today the details vary with specific configuration. The format of the files has changed very little since the '80ies, and with them the general meanings of the various fields are set in stone. Unix APIs for accessing user data still depend on the layout of those files.

Even later, processes could belong to several groups at the same time. Thus the user's processes (starting from the login shell) belonged to several groups simultaneously, getting all groups the user can belong to from /etc/group.

From the previous discussion, in modern Unix systems a user can belong to one primary group only (by force of legacy file format), but the distinction between primary and secondary groups has all but disappeared.