VMware ESXi and vSphere Cluster Management

Linux Groups: Primary Groups, File Ownership, and Permissions

Learn how Linux groups work, distinguish primary and supplementary groups, inspect file group ownership, read /etc/group, and troubleshoot group-based permissions.

Linux groups are named collections of user accounts. They make it practical to grant shared access to files, directories, devices, and other system resources without configuring every user separately.

This lesson explains primary groups, supplementary groups, file group ownership, permission classes, and the commands used to inspect them.

What Is a Linux Group?

A group is a named set of accounts used for shared authorization and ownership. For example, a project group could allow several developers to access the same project files.

Groups simplify administration. Instead of granting access to Alice, Bob, and Carol individually, an administrator can grant access to one group and manage membership in that group.

A permission can apply to the file's individual owning user, to users in the file's owning group, or to everyone else. These are called the owner, group, and other permission classes.

Linux File Permission Classes

Every file has an owning user and an owning group. Its traditional Unix permission string contains three classes:

Owner permissions: apply to the user who owns the file.
Group permissions: apply to users who belong to the file's owning group.
Other permissions: apply when the accessing user is neither the owner nor a member of the owning group.

Read permission allows the contents of a regular file to be viewed. Write permission allows its contents to be modified. Execute permission has additional meanings: it allows a program to run and, for a directory, permits traversal when combined with appropriate directory permissions.

For group access to work, both conditions must be true:

The user must belong to the file's owning group, usually through primary or supplementary membership.
The file's group permission bits must grant the required operation, such as read or write.

For example, a file could give its owner read and write access, its group read-only access, and other users no access. Members of the owning group could view the file but could not modify it.

-rw-r----- 1 alice editors 1200 Aug 18 10:30 report.txt

In this example, Alice is the owner, editors is the owning group, and members of editors have read permission but not write permission. The group is not automatically granted the owner's permissions; the group class is controlled by its own three bits.

Primary and Supplementary Groups

Every Linux user account has a primary group. This is the default group associated with the account and is commonly used for files and processes created by that user.

Many distributions create a private group with the same name as the user, such as user bob having primary group bob. This is a common pattern, not a universal rule. Distributions and administrative policies may use shared primary groups or another arrangement.

A supplementary group is an additional group membership. Supplementary groups can provide access to shared resources beyond the user's primary group. A user might have primary group bob and supplementary groups developers and backup.

Primary Versus Supplementary Membership

Concept | What it represents | How to inspect it

Primary group | The user's default group; commonly used for newly created files and processes | id

Supplementary groups | Additional memberships that may grant access | id or groups

File owning group | The group associated with a file or directory | ls -l or stat

Group ID | The numeric identifier, called a GID | id, stat, or getent

Local group record | A group entry in the local group database | getent group or /etc/group

Users, Groups, Processes, and New Files

A user account starts a process, such as a shell or text editor. That process has user and group credentials. When the process creates a file, the file receives the creating process's effective user and group identity, subject to directory rules and system behavior.

Under normal default behavior, a newly created file is associated with the creator's primary group. However, the result can differ if the process uses another effective group, if ownership is changed later, or if the parent directory has the setgid bit.

A setgid directory is configured so new files and subdirectories inherit the directory's group. This is useful for shared project directories because all new entries can remain associated with the project group even when users have different primary groups.

Finding a File's Group Ownership

Using ls -l

Use a long directory listing to inspect a file's owner and group:

ls -l filename

$ ls -l report.txt
-rw-r----- 1 alice editors 1200 Aug 18 10:30 report.txt

Read the output from left to right. The group field appears immediately after the owning user and before the file size, timestamp, and name.

Field order | Example value | Meaning

Permission string | -rw-r----- | File type and owner, group, and other permission bits

Link count | 1 | Number of hard links

Owning user | alice | User account that owns the file

Owning group | editors | Group associated with the file

Size | 1200 | File size in bytes

Timestamp | Aug 18 10:30 | Modification time

File name | report.txt | Name of the file

Using stat

The stat command displays more complete metadata, including named and numeric user and group ownership:

stat filename

Look for fields such as Uid and Gid. The output commonly includes both a name and a number, for example a group name together with its numeric GID.

Creating a Test File and Identifying Its Group

To observe ordinary default behavior, log in as a sample user such as bob, create a test file, and inspect it:

touch group-test.txt
ls -l group-test.txt
id

The listing shows the file's owning user and the following group field. Compare that group with the gid information from id. When no special directory or process settings apply, the file's group commonly matches the user's primary group.

Inspecting Current Group Membership

The id Command

Run id for the current account:

id

Typical output resembles:

uid=1001(bob) gid=1001(bob) groups=1001(bob),100(users),110(developers)

The uid value is the numeric UID, or user identifier. The gid value identifies the user's primary group. The groups list contains the complete group membership visible to the process, including the primary group and supplementary groups.

You can inspect another account with:

id username

The groups Command

Use groups to display group names for the current user:

groups

To inspect a specified user:

groups username

groups is convenient for names, while id also shows numeric UID and GID values and clearly identifies the primary GID.

Looking Up Group Account Information

/etc/group is the traditional local group database. It contains colon-separated records describing local groups. The file is generally readable so users and programs can look up group names, IDs, and membership information.

A typical record has this structure:

groupname:password-placeholder:GID:member1,member2

Position | Field | Purpose

1 | Group name | The name used to refer to the group

2 | Password placeholder | Usually an unused placeholder such as x; it is not normally a usable group password

3 | GID | The numeric group identifier

4 | Supplementary member list | Comma-separated users listed as additional members

The fourth field does not necessarily show every way a user may belong to a group. A user's primary group is represented by the user's account record, while supplementary membership may be listed here. Use system lookup commands for the effective view.

Use getent for General Lookups

Systems can obtain group records from local files, LDAP, Active Directory integration, or other centralized identity services. Therefore, getent is often preferable to checking only /etc/group:

getent group groupname

When local group files are being used, you can search the local record directly:

grep '^groupname:' /etc/group

Administrative changes should normally use account-management tools rather than manually editing /etc/group.

Using Groups for Shared Access

Suppose a team has groups named readers and editors. A file assigned to editors can grant that group read and write permissions:

-rw-rw---- 1 alice editors 1200 Aug 18 10:30 shared.txt

Members of editors can read and modify the file, while users outside the owner and group classes receive no access from these traditional permission bits.

Standard Unix permissions provide one group class per file. A single file cannot use its ordinary group bits to give one group read-only access and a different group read-write access at the same time. A separate file, a different ownership design, or access control lists may be needed for that arrangement.

Troubleshooting Group Ownership and Access

The File Group Is Not the Expected Primary Group

Possible causes include:

The file was created in a setgid directory and inherited the directory's group.
The creating process had a different effective group.
Someone changed the file's ownership after creation.

Check the relevant identities and directories:

id
ls -ld parent-directory
stat filename
stat parent-directory

A User Belongs to the Group but Cannot Modify the File

Membership alone does not grant write access. Check the file's group permission bits and the parent directory:

ls -l filename
ls -ld parent-directory
id username

Other restrictions may also apply, including ACLs, immutable attributes, or mandatory access controls. If ACLs are in use, inspect them with:

getfacl filename

The Group Is Missing from /etc/group

The group may come from LDAP, Active Directory integration, or another configured identity source. It may also have been misspelled or may not exist. Check the configured group databases with:

getent group groupname

Exam-Relevant Notes

A GID is a numeric group identifier; a UID is a numeric user identifier.
Every user has a primary group and may have supplementary groups.
New files normally use the creating process's effective group, commonly the user's primary group.
A setgid directory can make new entries inherit the directory's group.
In ls -l output, the owning group appears after the owning user.
Group membership must match the file's owning group, and the group permission bits must grant the requested access.
/etc/group is a local group database, but getent group is safer for systems using multiple identity sources.

Summary

Linux groups provide a manageable way to share access among user accounts. A user has a primary group and may have supplementary groups. Files have an owning user and an owning group, with separate permission bits for the owner, group, and other classes.

Use ls -l to locate a file's group, stat for detailed ownership metadata, id and groups to inspect membership, and getent group to query the system's configured group databases.