This question already has an answer here:

I asked the following question Added user supplementary group, but 'groups(1)' not showing change earlier today. Now I'd like to know why the answer works. After running

adduser user group

Why does user need to log out (I'm not even sure what that means in a context without a window manager), or why does newgrp(1) need to be invoked?

marked as duplicate by Gilles 'SO- stop being evil', jasonwryan, slm, Anthon, rahmu Oct 17 '13 at 22:09

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.


If you take a look at the man page, credentials you'll see why child processes cannot have changes made via adduser immediately reflected in a real-time way:


A child process created by fork(2) inherits copies of its parent's user and groups IDs. During an execve(2), a process's real user and group ID and supplementary group IDs are preserved; the effective and saved set IDs may be changed, as described in execve(2).

So what does this mean?

Logging out ends the parent process from which all your subsequent processes were forked from. Everything in your desktop etc. This original process had your groups info in it, which it populated by reading /etc/passwd & /etc/group.

Another file that plays a role in how your environment gets your groups information is /etc/nsswitch.conf. This file contains lines like this:

passwd:     files
shadow:     files
group:      files

This instructs your system to only read this information in regarding passowrds, groups, etc. from the files I just mentioned.

These lines could just as easily instruct the system to use other sources such as NIS, LDAP, etc. to acquire this information instead.


If you take a look at the nsswitch.conf man page you'll find out how the system is able to source the contents of the various "databases" of usernames, groups, and passwords.


       A service named SERVICE is implemented by a shared object library named 
       libnss_SERVICE.so.X that resides in /lib.

       /etc/nsswitch.conf       configuration file
       /lib/libnss_compat.so.X  implements `compat' source for glibc2
       /lib/libnss_db.so.X      implements `db' source for glibc2
       /lib/libnss_dns.so.X     implements `dns' source for glibc2
       /lib/libnss_files.so.X   implements `files' source for glibc2
       /lib/libnss_hesiod.so.X  implements `hesiod' source for glibc2
       /lib/libnss_nis.so.X     implements `nis' source for glibc2
       /lib/libnss_nisplus.so.2 implements `nisplus' source for glibc 2.1

       Within each process that uses nsswitch.conf, the entire file is read only
       once; if the file is later changed, the process will continue using the 
       old  configuration.

If you notice this note, it's reflecting a similar situation with this file, where changes to the nsswitch.conf can not be made in a real-time fashion either.

  • That's pretty helpful and deserves and up vote! It doesn't explain why "logging out/in" works however. – fthinker Oct 17 '13 at 3:03
  • @fthinker - logging out ends the parent process from which all your subsequent processes were forked from. This original process had your groups in it. – slm Oct 17 '13 at 3:04
  • I see. Now where does the new login process derive the newly added supplementary group? – fthinker Oct 17 '13 at 3:09
  • @fthinker - from the files that I mentioned, see my updates. – slm Oct 17 '13 at 3:13
  • @fthinker - logging out is one way to get these groups to show up. If you were to ssh localhost and login you'd see these groups in that shell too. It's the creation of a new process that isn't derived from a fork of an existing process that triggers the re-reading of the credential files to determine what groups you have available to you. – slm Oct 17 '13 at 3:17

It requires it because group membership is read at login. All of that information is stored with that session and not re-read.

  • 1
    Thanks. Could you provide a bit more information on how that relates to new processes I'm starting in my terminal, how that relates to login in a windows manager vs the non graphical way, and possibly how that (lack of ) information is maintained throughout new process creation? – fthinker Oct 17 '13 at 2:53
  • @fthinker I could, but it looks like slm did a better job when I was away. – kurtm Oct 17 '13 at 4:06

Not the answer you're looking for? Browse other questions tagged or ask your own question.