I'm wondering if you could change defaults groups for new users without having to specify all of them manually. I'm trying to harden my ArchLinux and there's a group (provided by Grsecurity) that is denying one to use any socket and therefore preventing him to use any backdoor.
I've seen some threads saying to use EXTRA_GROUPS and ADD_EXTRA_GROUP in /etc/default/useradd, and some other saying it's not possible because they are hard-coded in useradd binary. (I think it's really OS dependent)
(The goal is that if somehow someone used arbitrary remote code execution to create a new user he'd not be able to do anything with it because by default he will be in the said group. I know that if he has permission to create a user he has permission to change his groups but i guess it still adds one extra layer of security)
Thanks by advance