1

There is much discussion online about creating sudo users and groups, editing the sudoers file, etc.

For example, you might have sensitive configuration files or shell scripts, and you set the file ownership to root:root and then probably chmod to 0700 or something.

If you are logged in to your server as sudo, you can just sudo ... to access those files.

But I'm wondering if there's any good cases for adding a user, esp. sudo users, to the root group... is there ever a good reason for doing this, or should this never be needed if following best practices?

2
  • At a glance, on my Ubuntu 20 system, /var/log/firewalld is only readable to group root. Everything else in there is readable to only adm. (This might be an anomaly.)
    – user10489
    Aug 11, 2022 at 11:54
  • Can't say this is a good idea but IBM's Planning Analytics podman installation required adding the user to the root group. This restriction was only very recently lifted - too late for our configuration to be changed.
    – doneal24
    Aug 11, 2022 at 13:02

1 Answer 1

2

Unlike the root user, the root group does not bring any inherent powers or privileges. So any special permissions you get from group root are because of group permissions on files in the root group, or because of things like sudo that may be configured to give additional permissions.

At one time, the root group was used for sudo, and in many config files, this is still there in addition to the sudo group. Also, at the time, group 0 was called "wheel" rather than root. In the interests of clarity, I'll call group root "wheel" from here forward, to distinguish it from user root.

The trend in Unix security has been to have system files with ownership root:wheel with the presumption that this ownership makes the files harder to corrupt (or leak). As such, the trend has been to move away from using wheel for anything else and to create special groups such as sudo to replace wheel, and further separate and dilute any possible extra permissions of wheel.

So the determination if it makes sense to add a user to wheel rests entirely on what additional access that would give. If they are already in the sudogroup, then they don't need wheel to give access to that. Are there wheel files that have read or write access exclusive to wheel? Does the user in question need that, or would it be a problem if they had that?

For example, at one time, log files were only readable to root or wheel. The current trends, in trying to further separate that privilege, have changed the group of most log files to adm (or similar spelling), although there may still be some vestiges of log files in group wheel. Similar shifts have occurred in other areas to further dilute the permissions formerly covered by wheel.

Why would you need wheel (or adm) permissions if you have sudo anyway?

The thought is that the less you use sudo, and the less you make it a habit to use sudo, the less chance there is to accidentally do something as root that should have been done as a user. So needing to use sudo to (for example) examine a log file or even use filename completion to get the log file name is inconvenient, and possibly dangerous. It could be construed as better to instead add the user to the group of the file (and its parent directory) instead.

2

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .