What does it mean to be in group 0?

Question

Several users in a system I inherited have their group set to 0 in /etc/passwd. What does that mean? Do they essentially get full root privileges?

The system is running CentOS 5, and the users appear to be primarily system-related things, although a former administrator is also in that group:

$ grep :0: /etc/passwd
root:x:0:0:root:/root:/bin/bash
sync:x:5:0:sync:/sbin:/bin/sync
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
halt:x:7:0:halt:/sbin:/sbin/halt
operator:x:11:0:operator:/root:/sbin/nologin
jsmith:x:500:0:Joe Smith:/home/jsmith:/bin/bash
$

Answer 1

Unlike user 0 (the root user), group 0 does not have any special privilege at the kernel level.

Traditionally, group 0 had special privileges on many unix variants — either the right to use su to become root (after typing the root password), or the right to become root without typing a password. Basically, the users in group 0 were the system administrators. When group 0 has special privileges, it is called wheel

Under Linux, group 0 does not have any special meaning to privilege escalation utilities such as sudo and su, either. See Why is Debian not creating the 'wheel' group by default?

Under CentOS, as far as I know, group 0 has no special significance. It is not referenced in the default sudoers file. The administrators on that system may have decided to emulate a unix tradition and confer members of group 0 some special permissions. Check the PAM configuration (/etc/pam.conf, /etc/pam.d/*) and the sudoers file (/etc/sudoers) (these are not the only places where group 0 might have been conferred special privileges, but the most likely).

Answer 2

Unlike user ID 0, the kernel does not give any special permissions to group 0. However, since 0 is typically the default group for the root user, it means these people will often be able to access or modify files owned by root (since those files often also are owned by group 0).

In addition, some programs may treat group 0 specially. For instance, su on some BSD systems will grant passwordless root access to members of group 0.

So while it's not a superuser class, I'd still be careful of who is a member.

Answer 3

It simply means that their primary group is root rather than anything else and therefore, for example, they use the group settings when accessing files where group settings is root.

Most of the standard system files are owned by root.root but group permissions are usually the same as the world permissions so, by itself, this doesn't convey any advantage unless your system has had the group permissions changed on standard files.

It does not grant full root privileges.

Answer 4

I'm a bit late to the party but asked myself the same question today and came to the following conclusion:

This is against the principle of least privilege and should therefore be avoided.

More specifically this might give the user (read, write or exec) permissions not only to a lot of regular files and directories but also lots of special ones like that talk to your systems kernel.

But because this might be different for your system you should run this to find and inspect them all (first for read, second for write, eXecute is left as an excercise for the reader):

find / -group 0 -perm -g+r ! -perm -o+r  -ls | less 
find / -group 0 -perm -g+w ! -perm -o+w  -ls | less

Some of these may be regular files and directories (like the home directory /root) but others can be pseudo files that are interfaces into the kernel (like in /proc and /sys)

e.g.:

find /sys -type f -group 0 -perm -g+w ! -perm -o+w  -name 'remove'
/sys/devices/pci0000:00/0000:00:17.0/0000:13:00.0/remove
/sys/devices/pci0000:00/0000:00:17.0/remove
/sys/devices/pci0000:00/0000:00:16.6/remove
...
etc.

Use lspci -v |less to find out what those devices are (e.g.: Storage controller, USB controller, Network and video cards, etc.)