Managing groups

Table of Contents

Understanding Linux Groups in Practice

Groups let you manage permissions for sets of users at once. In this chapter, you’ll work with the actual tools and files used to manage groups on a Linux system and see how they interact with users and permissions.

Types of Groups and Common Use Cases

Linux mainly distinguishes:

Primary group

Every user has exactly one primary group.
Usually has the same name and ID as the user (on modern desktop/server distros).
Files created by the user typically inherit this primary group.

Supplementary (secondary) groups

A user can be a member of many supplementary groups.
Used to grant additional access (e.g. docker, sudo, audio, video).

Typical use cases:

Access to shared directories

Example: a projectx group so only project team members can read/write /srv/projectx.

Access to system resources

Audio devices: audio
Serial/USB devices: dialout, plugdev
Administrative tasks: sudo, wheel

Separation by department/function

dev, ops, finance, hr etc. for internal company structures.

Inspecting Group Information

Viewing Group Definitions

Groups are primarily defined in /etc/group. To view all groups:

bash

cat /etc/group

Example lines:

text

root:x:0:
sudo:x:27:alice,bob
developers:x:1001:alice,carol

Fields are colon-separated:

Group name (sudo)
Password placeholder (x or empty; usually not used directly)
Group ID (GID) (27)
Comma-separated list of members (alice,bob)

To print a specific group:

bash

getent group developers

getent is preferable on systems using LDAP/SSSD/other directory services because it shows all configured sources, not only /etc/group.

Checking Group Membership for a User

To see groups for the current user:

bash

groups

For a specific user:

bash

groups alice
id alice

id shows both user and group IDs, including primary group and supplementary groups.

Example:

bash

id alice

Output:

text

uid=1000(alice) gid=1000(alice) groups=1000(alice),27(sudo),1001(developers)

gid=1000 → primary group
groups=... → primary + supplementary groups

Creating and Removing Groups

Creating a Group

Use groupadd:

bash

sudo groupadd developers

To specify a particular GID:

bash

sudo groupadd -g 1050 qa

Useful options (may vary slightly by distro):

-g GID — explicit group ID
-r — create a system group (low GID, typically non-login/service-related)

Example:

bash

sudo groupadd -r backup

Deleting a Group

Use groupdel:

bash

sudo groupdel developers

Notes:

This does not remove files owned by that group; they will still have the old GID (which may later be reused).
Ensure no essential processes or services depend on that group before deleting it.

To find files using a group before deletion:

bash

sudo find / -group developers 2>/dev/null

Modifying Existing Groups

Changing Group Name

Use groupmod:

bash

sudo groupmod -n devteam developers

-n new_name — new group name.

Check result:

bash

getent group devteam

Changing GID

bash

sudo groupmod -g 1055 devteam

After changing GID, you should update file ownerships that still use the old GID:

bash

sudo find / -gid 1001 -exec chgrp -h 1055 {} +

Or using the new name:

bash

sudo find / -group devteam -exec chgrp -h devteam {} +

Use with care, especially on multi-user systems or production servers.

Adding and Removing Users from Groups

Managing membership is the most common group administration task.

Adding an Existing User to a Group

Using usermod:

bash

sudo usermod -aG developers alice

Explanation:

-a — append (without this, existing supplementary groups are replaced).
-G — list of supplementary groups.

Always include -a when modifying secondary groups for an existing user.

You can add to multiple groups at once:

bash

sudo usermod -aG sudo,developers,qa alice

Setting the Primary Group

To change a user’s primary group:

bash

sudo usermod -g devteam alice

Notes:

This does not automatically change group ownership of existing files.
Newly created files by alice will use devteam as their group (subject to directory setgid behavior).

Remove User From a Group (Safe Method)

Because forgetting -a with usermod is dangerous, many admins prefer using gpasswd or direct editing.

With gpasswd:

bash

sudo gpasswd -d alice developers

-d USER GROUP — remove user from supplementary group.

On some systems, you can also use deluser:

bash

sudo deluser alice developers

(Availability and syntax vary by distro.)

Effective Membership vs. Group Changes

Group changes typically apply only to new login sessions.
If you add a user to docker or sudo, they often need to:

Log out and log in again, or
Restart their SSH session, or
Use newgrp (see below) to change active group in an existing shell.

Managing Group Membership Interactively with `gpasswd`

gpasswd is the traditional tool for administratively managing /etc/group.

Common uses:

Add user to group:

bash

  sudo gpasswd -a alice developers

Remove user from group:

bash

  sudo gpasswd -d alice developers

Set an administrative user for a group:

bash

  sudo gpasswd -A adminuser developers

Set the list of members explicitly:

bash

  sudo gpasswd -M alice,carol developers

On modern systems, group passwords and group admins are rarely used, but you might still encounter gpasswd in documentation or legacy scripts.

Temporary Group Changes with `newgrp`

newgrp allows you to start a new shell with a different effective primary group.

Examples:

bash

newgrp developers

Now:

Your primary group in this shell is developers.
New files you create will be owned by group developers (subject to directory permissions).

You can return to your original primary group with:

bash

exit

Use cases:

When collaborating in a shared group directory with specific umask/setgid settings.
To immediately take advantage of new group membership without logging out entirely (though this is limited compared to fully re-logging in).

Working with Group-Specific Access

Once groups are created and users are assigned, you typically use file and directory permissions to enforce access. Here we focus on group-related aspects.

Setting Group Ownership

To change the group of a file or directory:

bash

sudo chgrp developers /srv/projectx

Recursively:

bash

sudo chgrp -R developers /srv/projectx

Combine with chmod to assign group access:

bash

sudo chmod -R 770 /srv/projectx

Here:

Owner + group: full access.
Others: no access.

Ensuring New Files Belong to the Group (setgid on Directories)

On shared directories, you often want all new files to be owned by the same group. You can use the setgid bit on a directory:

bash

sudo chgrp -R developers /srv/projectx
sudo chmod g+s /srv/projectx

Now:

Files created in /srv/projectx inherit the directory’s group (developers) instead of the creator’s primary group.
Useful for collaborative workspaces.

You can see the s in directory permissions:

bash

ls -ld /srv/projectx

Example:

text

drwxrws--- 5 root developers 4096 ... /srv/projectx

s in the group part (rws) indicates setgid is set for the directory.

Group-Based Shared Directories: A Typical Pattern

A common pattern for team collaboration:

bash

sudo groupadd projectx
sudo mkdir /srv/projectx
sudo chgrp projectx /srv/projectx
sudo chmod 2770 /srv/projectx
sudo usermod -aG projectx alice
sudo usermod -aG projectx bob

Explanation:

2770 → 2 sets setgid on the directory, 770 is rwxrwx---.
All files created there will belong to group projectx.
Only members of projectx (and root) can access it.

System vs Regular Groups

Most distros reserve a range of low GIDs for system groups used by services and daemons. You’ll see many such groups in /etc/group, for example:

text

daemon:x:1:
bin:x:2:
sys:x:3:
adm:x:4:syslog,alice
lp:x:7:
mail:x:8:
www-data:x:33:

Guidelines:

Avoid using low-numbered GIDs for human users/groups.
Don’t remove or rename system groups you don’t fully understand.
Use higher GIDs (automatically chosen by groupadd) for user groups.

Script-Friendly Group Management

On servers and in automation, you’ll often need idempotent operations (safe to run repeatedly).

Examples:

Ensure Group Exists

bash

if ! getent group developers >/dev/null; then
    sudo groupadd developers
fi

Ensure User Is in a Group

bash

if ! id -nG alice | grep -qw developers; then
    sudo usermod -aG developers alice
fi

These patterns are useful in shell scripts, provisioning tools, or when manually hardening/setting up a system.

Troubleshooting Group-Related Issues

Common problems and how to investigate them:

User still doesn’t have expected access after being added to a group

Confirm membership:

bash

     id alice

Ensure they logged out and back in (or restarted SSH).
Check the directory/file permissions:

bash

     ls -ld /path/to/resource

Permissions look correct, but access is denied

Check for:

Other permission constraints (ACLs, SELinux/AppArmor).
Wrong group assigned to the resource.

Use namei -l /path/to/resource to inspect permission on each path component.

User lost access after running usermod -G

-G without -a overwrote all supplementary groups.
Compare with another similar user, or check history.
Re-add the user to required groups.

Files show numeric GIDs instead of names

The group was deleted or not known to the system.
Check /etc/group and getent group.
Recreate the group with the same GID if needed:

bash

     sudo groupadd -g 1001 developers

Summary of Key Commands

Quick reference:

View groups:

getent group
getent group NAME
id USER
groups USER

Create/delete groups:

sudo groupadd NAME
sudo groupdel NAME

Modify group:

sudo groupmod -n NEWNAME OLDNAME
sudo groupmod -g NEWGID NAME

Manage membership:

sudo usermod -aG GROUP USER
sudo gpasswd -a USER GROUP
sudo gpasswd -d USER GROUP

Work with group-based permissions:

chgrp [ -R ] GROUP PATH
chmod g+s DIR (setgid on directory)

Mastering these tools lets you build clean, maintainable permission structures and avoid many common security and access problems on multi-user Linux systems.

Comments

Please login to add a comment.

Don't have an account? Register now!

Managing groups

Understanding Linux Groups in Practice

Types of Groups and Common Use Cases

Inspecting Group Information

Viewing Group Definitions

Checking Group Membership for a User

Creating and Removing Groups

Creating a Group

Deleting a Group

Modifying Existing Groups

Changing Group Name

Changing GID

Adding and Removing Users from Groups

Adding an Existing User to a Group

Setting the Primary Group

Remove User From a Group (Safe Method)

Effective Membership vs. Group Changes

Managing Group Membership Interactively with `gpasswd`

Temporary Group Changes with `newgrp`

Working with Group-Specific Access

Setting Group Ownership

Ensuring New Files Belong to the Group (setgid on Directories)

Group-Based Shared Directories: A Typical Pattern

System vs Regular Groups

Script-Friendly Group Management

Ensure Group Exists

Ensure User Is in a Group

Troubleshooting Group-Related Issues

Summary of Key Commands

Comments

Where to Move