Linux online course

Linux Groups and File Group Ownership

Learn how Linux groups control shared access, how primary and supplementary groups work, and how to inspect a file's group ownership with common commands.

Linux groups are named collections of user accounts. They provide a practical way to grant shared access to files, directories, devices, and other resources without assigning permissions to every user individually.

This lesson explains group ownership, primary and supplementary groups, file permission classes, and the commands used to inspect group information.

What Is a Linux Group?

A group is a named collection of user accounts used for shared authorization. Authorization means deciding which users may access a resource and what they may do with it.

For example, suppose five developers need access to a project directory. Instead of adding permissions for each developer separately, an administrator can place them in a group such as developers and assign access to that group.

Groups simplify administration because one permission rule can apply to many users at once. Adding a user to the group grants the group-based access; removing the user revokes that access.

Owner, group, and others

Linux file permissions are evaluated using three identity classes:

• Owner: the user account recorded as the file owner.
• Group: the group identity recorded as the file's owning group.
• Others: all users who are neither the owner nor members of the relevant group for permission evaluation.

These classes are separate. A file can give its owner read and write access, its owning group read-only access, and all other users no access. Group permissions are therefore different from permissions assigned directly to the owner or to others.

Groups and File Permissions

Every file and directory has an owning user and an owning group. It also has permission bits for reading, writing, and executing. The bits are arranged in owner, group, and others classes.

For a regular file, read allows viewing its contents, write allows changing its contents, and execute allows running it as a program when other requirements are satisfied. For a directory, these permissions have directory-specific meanings: read lists names, write creates or removes directory entries, and execute allows traversal and access to entries.

One owning group in standard mode bits

Traditional Unix mode bits provide one group permission class: the permissions for the file's single owning group. They do not provide separate mode-bit columns for several different groups.

For example, a shared document might use an owning group called editors with group read and write permission. Members of editors can then modify the document, while a separate read-only audience may need another design, such as a different directory arrangement, a copied or exported file, or access control lists (ACLs).

Groups can still support different access levels in a larger shared-file policy. One group might be assigned read-only access to a published directory while another collaboration group receives read and write access to the working directory. If multiple unrelated groups must receive different permissions on the same object, ACLs may be required.

Primary Groups

Every Linux user account has a primary group. The primary group is the user's default group identity.

Many Linux distributions use a user-private group: a group created for one user whose name commonly matches the username. For example, the user bob may have a primary group also named bob. This naming pattern is common, but it is not a requirement of Linux.

New files and processes

When a user creates a file, the file is normally assigned that user's primary group. A newly created process also normally starts with the user's primary group as its effective group identity, along with supplementary group memberships.

The final group ownership of a new file can be affected by the parent directory. In particular, a directory with the setgid permission bit can cause new files and subdirectories to inherit the directory's group instead of simply using the creator's primary group.

Supplementary Groups

A supplementary group is an additional group that grants a user access beyond the primary group. A user may belong to many supplementary groups, such as developers, audio, or backup.

Identifying a File's Group

Use a long listing with ls -l to inspect a file's ownership and permissions:

$ ls -l report.txt
-rw-r----- 1 bob developers 2048 Aug 17 10:30 report.txt

In this example, bob is the owning user and developers is the owning group. The group name appears after the owning username and before the file size.

Practical example: a newly created file

Log in as a sample user such as bob, create a file, and inspect it:

$ touch notes.txt
$ ls -l notes.txt
-rw-r--r-- 1 bob bob 0 Aug 17 10:45 notes.txt

If bob's primary group is also named bob, the listing commonly shows bob in both the owner and group columns. Confirm the user's primary group with id rather than assuming the names always match.

Group Account Information

On traditional Linux systems, /etc/group is the local group database. It normally contains group names, numeric group identifiers, and supplementary member lists.

A typical entry has four colon-separated fields:

groupname:password-placeholder:GID:member1,member2

• Group name: the group's name.
• Password field: usually a placeholder; group authentication is not normally managed through this visible field.
• GID: the numeric group identifier.
• Supplementary member list: a comma-separated list of users recorded as members.

The file is generally readable so users and programs can look up group information. However, the complete result of a user's membership lookup may also depend on configured identity services.

Local and system-aware lookups

To search the local file for a group named developers, use:

$ grep '^developers:' /etc/group

For a system-aware lookup, use getent:

$ getent group developers
developers:x:1002:alice,bob

getent group groupname consults the configured name-service sources. Depending on system configuration, those sources can include local files, LDAP, Active Directory integration, or another directory service. Therefore, a group may be available through getent even when it has no line in /etc/group.

Inspecting a User's Groups

Using id

The id command displays a user's numeric and named identity information:

$ id bob
uid=1001(bob) gid=1001(bob) groups=1001(bob),1002(developers),1003(backup)

• uid= identifies the user's numeric user ID and name.
• gid= identifies the user's primary numeric group ID and group name.
• groups= lists the primary group and supplementary groups known for the user.

Run id without an argument to inspect the current user:

$ id

You can inspect another user with id username, subject to the system's identity and privacy policies.

Using groups

The groups command provides a concise membership list:

$ groups bob
bob : bob developers backup

Although this output is convenient, id is better when you need to distinguish the primary group from supplementary groups because it explicitly shows the gid= field.

Troubleshooting Group Ownership and Access

A new file has an unexpected group

1. Check the creator's primary group with id username.
2. Inspect the parent directory's group with ls -ld directory.
3. Check whether the directory has the setgid bit. A mode string containing s in the directory's group-execute position can indicate it.
4. Remember that a setgid directory can make new files inherit the directory's group.

A user belongs to a group but cannot modify a file

1. Run ls -l filename and confirm that the file's owning group is the group the user belongs to.
2. Verify that the group permission portion contains w.
3. Check the permissions on every parent directory; directory traversal requires appropriate execute permission.
4. Consider ACLs, immutable attributes, filesystem mount options, or other security controls that may impose additional restrictions.
5. If membership was recently changed, start a new login session. Existing sessions may not have the updated supplementary group list.

The expected group is absent from /etc/group

Use getent group groupname. The system may obtain the group from LDAP, Active Directory, or another configured identity source rather than from the local file. Also check the exact spelling and, when relevant, the numeric GID.

The group column shows a number

If ls -l displays a numeric value instead of a group name, the system could not map that GID to a known group name through its configured identity sources.

$ getent group 1002

Use the result to investigate the GID and review the system's group-directory configuration if necessary.

Exam-Relevant Summary

• A group is a named collection of users used to grant shared access rights.
• Files and directories have both a file owner and an owning group.
• Permission classes are owner, group, and others; each class can have read, write, and execute bits.
• Every user has one primary group and may have multiple supplementary groups.
• A user's primary group normally becomes the group of newly created files and processes, unless directory behavior such as setgid changes the result.
• In ls -l output, the owning group appears after the username and before the file size.
• id shows the primary group in gid= and memberships in groups=.
• groups gives a concise membership list.
• /etc/group stores local group definitions, while getent group performs a system-aware lookup.
• Standard mode bits provide one owning-group permission class. Different permissions for several groups may require ACLs or a carefully designed shared-group workflow.

To continue, review Linux topics, practice basic shell commands with Bourne Again Shell Bash, and learn how to identify files with Determine File Type.