4

When the file owner is part of several groups, how does ls -l decide which group to show? For example, on MacOS, I see

drwx------+  48 flow2k  staff             1536 Feb  5 10:11 Documents
drwxr-xr-x+ 958 flow2k  _lpoperator      30656 Feb 22 16:07 Downloads

Here groups shown for the two directories are different (staff and _lpoperator) - what is this based on? I am a member of both groups.

Improve this question

2 Answers 2

Reset to default
9

I think this question stems from a misunderstanding of how groups work. The groups listed in ls -l are not the group that the user is potentially in, but the group that the file is owned by. Each file is owned by a user and a group. Often, this user is in the group, but this is not necessary. For example, my user is in the following groups:

$ groups
audio uucp sparhawk plugdev

but not in, say, the group cups. Now, let's create a file.

$ touch foo
$ ls -l foo
-rw-r--r-- 1 sparhawk sparhawk 0 Feb 23 21:01 foo

This is owned by the user sparhawk, and the primary group for me, which is also called sparhawk. Let's now change the group owner of the file.

$ sudo chown sparhawk:cups foo
changed ownership of 'foo' from sparhawk:sparhawk to sparhawk:cups
$ ls -l foo
-rw-r--r-- 1 sparhawk cups 0 Feb 23 21:01 foo

You can see that the group that now owns the file is not a group that I am in.

This concept allows precise manipulation of file permissions. For example, you could create a group with members X, Y, and Z, and share files between the three of them. You could further give X write permissions, but only give the others (the group) read permissions.

Improve this answer
6
  • There is rarely a need to use sudo to set permissions.
    – ctrl-alt-delor
    Commented Feb 23, 2019 at 12:18
  • 1
    @ctrl-alt-delor Was that the -1? Even if I had used sudo unnecessarily, that seems harsh. In any case, I tested the commands as I wrote the answer. Without sudo, I got chown: changing ownership of 'foo': Operation not permitted. If, however, I chown with a group I am a member of, then sudo is not required. Is it different on your system?
    – Sparhawk
    Commented Feb 23, 2019 at 12:41
  • @Sorry I can't remember why the -1, maybe I pressed the wrong button. You are correct, that you can not change the owning group, to a group that you are not in. But why do you have to? (maybe sgid for executable) You can use ACLs.
    – ctrl-alt-delor
    Commented Feb 23, 2019 at 15:32
  • There was indeed a misunderstanding on my part; thanks for clarifying that up. So, for my case, it would seem some other process, perhaps the OS, had somehow assigned different group owners for Documents and Downloads. Is this your interpretation as well?
    – flow2k
    Commented Feb 24, 2019 at 8:43
  • @flow2k Probably? It could also be a change in the primary group, but either way, I would ask a new question about this.
    – Sparhawk
    Commented Feb 24, 2019 at 9:18
2

In traditional permissions a file will belong to one group, no matter how many groups a user belongs to.

When a file is created The group is set to the primary group of the user. The user can then move it to any of their groups.

If you have ACLs (Posix ACLs, may differ from ACLs on MacOS)

then there can be more than one group. However ls only shows the first group, and the mode shows the group mask. (This can be confusing. It would be better if it showed ACL for the group name).

A user can not change the first group to any group that they are not a member of. But they can add auxiliary group and user permissions (for any group or user).

You do not need root (sudo) permissions to do any of this.

Improve this answer
7
  • 2
    Note that this is granting permissions to groups, not changing the "group owner" of the file. It's a subtle difference. Granting permissions doesn't need sudo, but changing ownership may.
    – Stephen Harris
    Commented Feb 23, 2019 at 13:34
  • What more can an owning group do?
    – ctrl-alt-delor
    Commented Feb 23, 2019 at 15:29
  • As you hinted in another comment, setgid gives the process the effective group permission of the group owner.
    – Stephen Harris
    Commented Feb 23, 2019 at 18:12
  • @StephenHarris Doesn't chown always require sudo?
    – flow2k
    Commented Feb 24, 2019 at 2:39
  • 1
    @flow2k chgrp can change the group of a file that you own, to any group that you are a member of. And yes changing owner will need privileges (however there are ways around it, if you have write access to the directory).
    – ctrl-alt-delor
    Commented Feb 24, 2019 at 14:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .