All about Unix groups and access control.

Under Unix each process and each resource belongs to a group. A group is internally represented by a group identifier (GID). The translation between group names and GIDs is stored in the file /etc/group. This is a simple line-oriented database, where each record contains four fields: group name, group password, GID, and a comma-delimited list of users who have GID as secondary group (see below). The use of group passwords is discouraged. Following the pattern of /etc/passwd and /etc/shadow an according file /etc/gshadow was established.

The group membership of a process is stored in the file /etc/passwd; this is also a line-oriented database where each record contains among other things the user name, the UID and the primary GID of the according user account. Unlike resources a process may belong to additional groups. These are stored in the fourth field of /etc/group, i.e. a user belongs to each group for which his username is included in the fourth field of the according entry.

A typical entry in /etc/group looks like this:

wheel:*:10:root,joe,fred

In this example the users root, joe, and fred have the group wheel as one of their secondary groups.

It is custom to reserve GIDs 0 to 99 for system groups and 100 to 499 or 999 to functional group accounts such as services, see /etc/login.defs on Linux distributions that use the shadow suite. A special group is wheel. If configured, only members of that group may use su and do certain other things. Traditionally this group had GID 0 but it has become custom to assign this group GID 10.

Files and other resources can have only one group. The group membership of a file is stored in its inode.

The groups a process is in and the group a resource belongs to have influence on access control decisions. Suppose a process tries to access a resource: If

  • the UID of the resource does not match the (effective) UID of the process
  • the GID of the resource does match the (effective) GID or one of the secondary GIDs of the process

then the group access right of the resource apply.

Common problems

history | excerpt history