5

I know a little about users and groups; in the past I might have had a group like 'DBAS' or 'ADMINS' and I'd add individual users to each group...

But I was surprised to learn I could add users to other users - as if they were groups.

For example if my /etc/group contained the following:

user1:x:12501:
user2:x:12502:user1
admin:x:123:user2,jim,bob

Since user2 is a member of the admin group, and user1 is a member of user2 - is user1 effectively an admin? If the admin group is in the sudoers file, can user1 use it as well?

I've tried to simulate this and I haven't been able to do so as user1...but I'm not sure it's impossible.

EDIT: SORRY - updated error in question.

2 Answers 2

9

In your example you:

  • Have the user user1 as a part of the group user2.
  • Have the user user2 as a part of the group admin.

The user user1 is distinct from the group user1.

Since (the user) user2 is a member of the admin group, and (the user) user1 is a member of (the group) user2 - is user1 effectively an admin?

  • No, the user user2 is a member of the admin group. Not the group user1.

If the admin group is in the sudoers file, can (the user) user2 use it as well?

  • Yes, just as the other users which are members of the group, jim and bob.

If the admin group is in the sudoers file, can user1 use it as well?

  • No, since the admin group only consists of users. It has the user user2 in it. Even though the user user1 is part of the group user2. They are different things, but share the same name in this and many distros setup. Groups on one side, users on the other. If the names match, they are still entierly different things.

To sum it up: Separate the user from the group. The names may be the same, but they refer to different entities. In GNU/Linux you do not have groups inside groups, a group can only contain users (which is different from say Windows).

2
  • My apologies - I made a typo in the question. It should have read 'If the admin group is in teh sudoers file, can the user2 use it as well'. I believe, from your answer, it should be 'no'.
    – Rob P.
    Oct 14, 2012 at 21:14
  • I added the updated question too. As you understood, it's no. It's easy to confuse them for the same thing when they are named the same.
    – Deleted
    Oct 14, 2012 at 21:22
5

A bit of background: in Linux, a user is always a member of a primary group and also can be a member of zero or more of secondary groups.

When a user creates a file, the file's user ID and group ID are set to the ID of the user and her primary group respectively, so the file becomes "owned" by that user and group. Also, permissions on the file are set automatically using the current umask setting, which includes permissions for "user", "group" and "others". So, more or less, all users in the same group as user's primary group are getting at least some permissions on the files the user creates.

Secondary groups, on the other hand, do not affect ownership of the files user creates, you can think of them as a way to allow access to files created by others.

As you can see, the "automatic" behavior of the primary group makes it a bit prone to allowing access unintentionally. For this reason, Ubuntu along with many other Linux distributions uses User Private Group scheme - when a user is created, a group with the same name is created and is set as the primary group of that user. So the user's primary group is always a group with exactly one member.

From CentOS documentation:

Red Hat Enterprise Linux uses a user private group (UPG) scheme, which makes UNIX groups easier to manage.

A UPG is created whenever a new user is added to the system. A UPG has the same name as the user for which it was created and that user is the only member of the UPG.

UPGs make it safe to set default permissions for a newly created file or directory, allowing both the user and the group of that user to make modifications to the file or directory.

The setting which determines what permissions are applied to a newly created file or directory is called a umask and is configured in the /etc/bashrc file. Traditionally on UNIX systems, the umask is set to 022, which allows only the user who created the file or directory to make modifications. Under this scheme, all other users, including members of the creator's group, are not allowed to make any modifications. However, under the UPG scheme, this "group protection" is not necessary since every user has their own private group.

So, as you can see, there's no "user is a member of another user" thing - as @Kent mentions, in Linux users cannot "contain" other users and also groups can not be nested and can only contain users, not other groups. The source of your confusion is that within User Private Group scheme user's primary group is a "private" group with the same name as the user.

2
  • "in your example, user2's primary group is set to user1". Actually, there is nothing saying that. The primary group is set in etc/passwd which he didn't mention. Of course, it can be assumed from the scheme used, but we can't know it from the information given.
    – Deleted
    Oct 14, 2012 at 23:05
  • @Kent: yeah, you're right, I've misread the question
    – Sergey
    Oct 14, 2012 at 23:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .