Groups let you grant permissions to several users at once. Instead of giving each developer access to /var/www/site one by one, you create a group, give the group access, and add people to it. Groups also control who may use sudo, Docker and other privileged tools.

Primary and supplementary groups

Every user has:

  • one primary group, usually a group with the same name as the user, created along with the account. New files you create belong to this group;
  • any number of supplementary groups that grant extra access, such as sudo, docker and www-data.

See group membership

groups              # your groups
groups alice        # someone else's
id alice            # uid, gid and all groups with their numbers
getent group docker # members of a group

Group definitions live in /etc/group:

docker:x:998:alice,bob

That’s the name, password placeholder, GID and member list. Use getent group rather than reading the file directly. It also covers LDAP and SSSD groups.

Create and delete groups

sudo groupadd developers
sudo groupadd -g 2001 deploy        # with a specific GID (keep GIDs consistent across servers)
sudo groupadd -r appsvc             # system group (low GID, for services)
sudo groupdel developers
sudo groupmod -n devs developers    # rename

You can’t delete a group that’s still some user’s primary group.

Add a user to a group

sudo usermod -aG developers alice

The -a (append) is essential. usermod -G developers alice without -a replaces all of alice’s supplementary groups, which can silently remove her from sudo. More in usermod.

Alternatives:

sudo gpasswd -a alice developers     # add
sudo adduser alice developers        # Debian/Ubuntu helper

Several users at once: sudo gpasswd -M alice,bob,carol developers (this sets the complete member list).

Remove a user from a group

sudo gpasswd -d alice developers
# or on Debian/Ubuntu:
sudo deluser alice developers

Apply membership without logging out

Group membership is read at login. After adding yourself to a group, existing sessions don’t have it yet, so docker ps still says “permission denied”. Options:

newgrp docker        # start a new shell with the group active
su - $USER           # fresh login shell

Or simply log out and back in over SSH. Long-running services need a restart to pick up new group memberships.

Shared team directory

A classic setup: several deploy users who all need to edit /srv/shared.

sudo groupadd webteam
sudo usermod -aG webteam alice
sudo usermod -aG webteam bob

sudo mkdir -p /srv/shared
sudo chown root:webteam /srv/shared
sudo chmod 2775 /srv/shared
  • 775 lets the group read, write and enter the directory.
  • The leading 2 is setgid: new files and subdirectories inherit the webteam group instead of the creator’s primary group. Without it, files end up owned by alice:alice and bob can’t edit them. See setuid, setgid and sticky bit.

Users also need a umask that leaves files group-writable (002). See umask. For finer control, use ACLs.

Groups for web servers

A common pattern for PHP sites: files are owned by a deploy user, and the group is the web server’s (www-data on Debian/Ubuntu, nginx or apache on RHEL):

sudo chown -R deploy:www-data /var/www/example.com
sudo find /var/www/example.com -type d -exec chmod 750 {} +
sudo find /var/www/example.com -type f -exec chmod 640 {} +
# writable upload directory
sudo chmod -R 770 /var/www/example.com/public/uploads

The web server can read everything and write only where needed. See Linux file permissions.

Privilege groups to treat carefully

Group Grants
sudo (Debian/Ubuntu) / wheel (RHEL) Run any command as root with sudo
docker Full control of Docker, which is equivalent to root
lxd Container control, also root-equivalent
adm Read system logs
systemd-journal Read the full journal

Only add trusted users to these. See sudo and sudoers and Docker socket permission.

Quick reference

Task Command
My groups id / groups
Members of group getent group name
Create group groupadd name
Add user usermod -aG group user
Remove user gpasswd -d user group
Delete group groupdel name
Activate now newgrp group
Change file group chgrp group file

Related: useradd and chown.

  • Linux
  • Users
  • Permissions