Linux
Beginner 11 min read Linux

Groups & Group Management

Groups bundle users together so permissions can be granted to a team instead of one person at a time. Learn what groups are, the difference between primary and secondary groups, the /etc/group file, creating groups with groupadd, adding members with usermod -aG, removing groups with groupdel — and why group ownership plus the setgid bit is the right way to share resources.

linux groups/etc/groupgroupaddgroupdelgroupmodprimary groupsecondary groupusermod -aGgetent groupshared resources
Prerequisites: User Management
Introduction

What is this?

A group is a named collection of users that Linux uses to grant permissions to a team instead of to individuals. Every user has exactly one primary group — which new files they create belong to by default — plus any number of secondary groups that expand what they can access. Group management is the craft of creating groups with groupadd, adding members with usermod -aG, removing them with groupdel, and pairing group ownership with the setgid bit so shared directories work without world-writable modes.

Motivation

Why do you need it?

  • Scale: one chgrp grants or revokes access for a whole team instead of editing per-user permissions across hundreds of files.
  • Shared resources without 777: a group-owned directory with group write lets the team collaborate and keeps everyone else out.
  • Cleaner audits: file ownership and sudo rules reference groups, so 'who has access' is one query — getent group web.
  • Tool and device access: the docker, dialout and www-data groups control sockets, serial devices and web content — joining a group is the standard way to grant tool access.
  • Default safety: because new files inherit the creator's primary group, group policy is your first line of permission hygiene.
Think about it

Mental model

Imagine

A company badge that opens specific floors and meeting rooms

Think of

Linux groups

Your ID card is your user account; the doors your badge opens are your group memberships. One badge template change by security re-issues access for a whole team — you don't reprint everyone's card. A 'security badge' group (sudo/wheel) opens doors most people can't, and it's revoked the same way.

Mechanics

How it works

  • Every user has exactly one primary group, defined by the gid field in /etc/passwd; it is the group that owns files the user creates and is used for the user's default group check.
  • A user can also be a member of any number of supplementary (secondary) groups, listed as comma-separated usernames in /etc/group — these expand access checks but never become the group of new files.
  • /etc/group stores one line per group: name, an x password placeholder, the gid, and the supplementary member list; the primary group membership is deliberately not repeated there.
  • groupadd registers a group by allocating the next free gid and writing to /etc/group; groupmod renames or renumbers it; groupdel removes it without touching any member accounts.
  • The kernel caches a user's full group list at login, so membership changes only take effect in a new session — adding someone to docker or web is a 'log out and back in' operation.

How a user's group list is built and used for access checks.

User logs in
PAM reads membership
Kernel caches the credentials
Access check
Grant or deny
Reference

Key commands

getent group web

Show the web group's line as the name service sees it: gid and current supplementary members.

web:x:1002:alice,bob
grep -E '^(web|sudo):' /etc/group

Inspect raw /etc/group entries for two groups.

web:x:1002:alice,bob
sudo:x:27:alice
groupadd web

Create a new group; the system allocates the next free gid automatically.

No output on success — verify with getent group web.
usermod -aG web alice

Append alice to web as a supplementary member without touching her other groups.

No output on success — alice gains web at her next login.
groups alice

List alice's secondary group memberships only.

alice : alice sudo web
id alice

Show the full picture: uid, primary gid and all groups.

uid=1001(alice) gid=1001(alice) groups=1001(alice),27(sudo),1002(web)
groupdel web

Delete the group. Files already owned by gid 1002 keep it as a numeric group.

No output on success — the name is gone from /etc/group.
Hands-on

Examples

Give a team a shared, group-writable staging area

Give a team a shared, group-writable staging area
# 1. Create the team group
sudo groupadd web
 
# 2. Add both developers as supplementary members
sudo usermod -aG web alice
sudo usermod -aG web bob
 
# 3. Create the staging directory and hand it to the group
sudo mkdir -p /srv/staging
sudo chgrp web /srv/staging
 
# 4. Group full access, no access for others, setgid for inheritance
sudo chmod 2770 /srv/staging
 
# 5. Verify memberships and the resulting mode
getent group web
ls -ld /srv/staging

chgrp web claims the directory for the team, and chmod 2770 sets rwxrwx--- plus the setgid bit — shown as s in the group position. From now on every file the team creates inside /srv/staging inherits group web automatically, so nobody needs chown or root to share work.

Real world

In production

  • Service groups gate sensitive resources: docker controls the Docker socket, dialout the serial ports, kvm the virtualisation devices — membership is how tool access is granted and revoked.
  • Team workspaces use a setgid project directory, so every new file from developers or CI inherits the project group and no one fights over chown.
  • CI/CD runners join groups that unlock credential mounts or artifact volumes only for the duration of a job.
  • Compliance reviews become a one-liner: getent group prod-admin is the living access list for 'who can touch production'.
Guidelines

Best practices

  • Prefer groups over world-writable anything: chgrp + chmod g+s beats chmod 777 every time.
  • Always append with -aG; a bare usermod -G silently replaces every other secondary group.
  • Name groups for what they grant (docker, web-deploy, audit) so membership is self-documenting.
  • Let gids be allocated automatically; reserve 0-999 for system groups and 1000+ for humans.
  • Re-login after membership changes — the kernel keeps the session's group list from login time.
  • Review membership when people change roles; group membership is exactly the access you are granting.
Watch out

Common mistakes

  • Editing /etc/group by hand instead of groupadd/usermod/groupmod — one malformed line can lock people out of shared resources.
  • Dropping the -a: usermod -G web alice replaces all supplementary groups, silently revoking docker, sudo and more.
  • Expecting new groups to apply to the current shell — membership is fixed at login until the user re-authenticates.
  • Deleting a group that still owns files: the files keep the numeric gid and group checks quietly break.
  • Confusing primary with supplementary: usermod -g changes what new files are owned by, while -aG only changes access.
Root cause analysis

Common issues

Error
groupadd: group 'web' already exists
Root cause

A group with that name already exists in /etc/group.

Fix

Check with getent group web and reuse it, or pick a different name.

Error
usermod: user 'alice' does not exist
Root cause

The account is missing or the name was mistyped.

Fix

Confirm with id alice; create the account first with useradd -m -s /bin/bash alice.

Error
Membership was added but permission is still denied
Root cause

The user's session predates the change — the kernel caches the group list at login.

Fix

Have the user log out and back in (or run su - alice), then verify the fresh list with id alice.

Error
New files keep the wrong group in the shared directory
Root cause

The directory has no setgid bit, so new files take the creator's primary group.

Fix

Run chmod g+s on the directory so new entries inherit the directory's group.

When things break

Debugging tips

  • Compare id and getent group: id shows the live session list, getent group shows who's listed — mismatches mean a stale login.
  • ls -ld shows the directory's group and the setgid s in the group position; ls -l shows each file's group.
  • find / -gid 1002 surfaces every file orphaned by a deleted group.
  • After usermod -aG, verify with su - alice -c 'id' (a fresh login) rather than trusting the old shell.
  • A + at the end of ls -l output means ACLs are layered on top of the group bits — check getfacl before debugging blind.
Interviews

Interview checkpoint

Practice

Hands-on lab

Create groups and share resources safely
11 min · beginner
In progress
Objectives
  • Create groups with groupadd and inspect /etc/group
  • Add users to supplementary groups with usermod -aG
  • Verify memberships with id, groups and getent
  • Share a directory via group ownership plus the setgid bit
  • Remove a group with groupdel and observe what remains

Create groups and share resources safely

11 min · beginner

0/7 steps
0%
sandbox · Linux sandbox
$
Try these commands
Test yourself

Quick quiz

0/6
1

Which file lists a group's name, gid and supplementary members?

2

By default, a new file created by alice is owned by which group?

3

usermod -G web alice adds alice to web without affecting her other groups.

4

What does the setgid (g+s) bit do on a directory?

5

alice was added to the docker group with usermod -aG docker alice, but docker ps still reports permission denied. What is the most likely cause?

6

Which command shows a user's full set of group memberships, including the primary group?

Quick reference

Cheat sheet

Inspect groups
getent group <name>group line from the real name service
cat /etc/groupraw group database: name:x:gid:members
groups <user>secondary groups of a user
id <user>uid, primary gid and all groups
find / -gid <gid>every file owned by a group
Manage groups
groupadd <name>create a group with the next free gid
groupadd -g 1500 webcreate with a specific gid
groupmod -n newname oldnamerename a group
groupdel <name>delete a group (files keep the numeric gid)
Manage membership
usermod -aG web aliceappend alice to web — always keep -a
gpasswd -a alice webadd a member (alternative tool)
gpasswd -d alice webremove a member
newgrp webstart a new session with web as the group
Share resources with groups
chgrp web /srv/dataclaim the directory for the group
chmod 2770 /srv/datagroup read/write/execute, others none, + setgid
chmod g+s /srv/datanew files inherit the directory's group
chgrp -R web /srv/datarecursively reassign group ownership
Key concepts
primary groupfrom /etc/passwd — owns new files by default
supplementary groupsfrom /etc/group — extend access only
membership is cached at loginchanges need a fresh login to apply
Go deeper

Official documentation

group(5) man page
docs
groupadd(8) man page
docs
usermod(8) man page
docs
getent(1) man page
docs
gpasswd(1) man page
docs