groups

Overview

Managing access one user at a time does not scale. Groups let you assign permissions to many users at once by collecting them under a shared name. This lesson explains groups and how they simplify access control.

Learning objectives

• Define a Linux group and its purpose.
• Distinguish primary from supplementary groups.
• Explain how group membership grants access.

Core concept

A group is a named collection of users, identified by a numeric GID (group ID). Groups let permissions be granted collectively: instead of giving ten users access to a file individually, you give the group access and add those users to it. Each user has:

• A primary group — assigned at account creation, used as the group owner of files they create.
• Supplementary (secondary) groups — additional memberships that grant extra access (e.g. sudo, docker, a project group).

How it works

Files have both a user owner and a group owner, and permissions can be set for that group (covered in the permissions module). When the system checks access, it considers the acting user's group memberships: if a file grants access to a group the user belongs to, the user gets that access. This lets administrators manage capabilities by role — add someone to the right group and they gain the associated access, remove them and it is revoked.

Practical example

$ id alice
uid=1000(alice) gid=1000(alice) groups=1000(alice),27(sudo),1001(project)

Alice's primary group is alice (GID 1000); she is also a supplementary member of sudo (able to elevate privileges) and project (say, shared access to a project directory). Files owned by the project group that grant group access are reachable by every member of project, Alice included.

Cybersecurity relevance

Group membership is a common vector for both legitimate access management and privilege issues. Membership in powerful groups (like sudo, wheel, or docker) effectively grants elevated capability — the docker group, for instance, often equates to root-level power. During assessment, checking a user's groups reveals what they can reach and whether membership is overly broad. Least-privilege applies to groups too: users should belong only to the groups their role requires.

Common mistakes

• Confusing primary and supplementary groups — one is the default file group; the others add access.
• Overlooking powerful group memberships (sudo, docker, wheel) that grant elevated capability.
• Granting broad group membership beyond what a role needs, widening access unnecessarily.

Key takeaways

• A group is a named set of users (identified by a GID) used to grant permissions collectively.
• Users have one primary group (default owner of files they create) and any number of supplementary groups that add access.
• Group membership drives access decisions; membership in powerful groups (sudo/docker/wheel) can equal elevated privilege, so least privilege applies to groups too.

Check your understanding

• What is the difference between a user's primary group and a supplementary group?
• Why is membership in a group like docker or sudo security-significant?