Can I add members of a group to another group automatically?

Question

Is there a way to ensure that when a user is added to a permissions group on a system, that user is automatically added to one or more other defined groups?

For example adding a user to a group created as netadmin would add the user to the groups www-data, tomcat, sambashare and ftp. (This is only a hypothetical situation)

Another example group of vmadmin could add a user to the groups, kvm, libvirt and vboxusers.

I know that a group cannot be added to a group, but would like to avoid having to set up and maintain ACLs for different directories and files.

Answer 1

I don't think there's a built-in way to do that.

However there's a pretty easy solution: you could add a function to ~/.bashrc to wrap the whole task into a single command.

Listing the sets of groups in a case statement (ok for a few sets of groups)

function add_user {
    [ ! -z "$1" -a ! -z "$2" ] || return
    case "$1" in
    netadmin)
        groups=(netadmin www-data tomcat sambashare ftp)
        ;;
    vmadmin)
        groups=(kvm libvirt vboxusers)
        ;;
    *)
        printf "Group '%s' is not listed.\n" "$1"
        return
    esac
    printf "Adding '%s' to group '%s'...\n" "$2" "$1"
    usermod -aG ${groups[@]} "$1"
}

After that running e.g. add_user netadmin user will add user to netadmin, www-data, tomcat, sambashare and ftp, and running e.g. add_user vmadmin user will add user to kvm, libvirt and vboxusers.

Adding other sets of groups would be as easy as adding other entries to the case statement after the vmadmin entry and before the * entry:

foo)
    groups=(bar foobar raboof)
    ;;

Listing the sets of groups in an external configuration file

Create a file named config in ~/ whith the following content:

netadmin,netadmin,www-data,tomcat,sambashare,ftp
vmadmin,kvm,libvirt,vboxusers

• The first field identifies the name of the set of groups
• The fields after the first identify the groups to which the user is to add

function add_user {
    [ ! -z "$1" -a ! -z "$2" ] || exit
    groups=( $(awk -F , -v group="$1" '$1==group {$1=""; print; exit}' config) )
    if [ ${#groups} -eq 0 ]; then
        printf "Group '%s' is not listed.\n" "$1"
        return
    fi
    printf "Adding '%s' to group '%s'...\n" "$2" "$1"
    usermod -aG ${groups[@]} "$1"
}

After that running e.g. add_user netadmin user will add user to netadmin, www-data, tomcat, sambashare and ftp, and running e.g. add_user vmadmin user will add user to kvm, libvirt and vboxusers.

Adding other sets of groups would be as easy as adding another entry to ~/config:

foo,bar,foobar,raboof