FreeBSD Handbook
Prev | Chapter 14 Users and Basic Account Management | Next

# 14.5 Groups

A group is a list of users. A group is identified by its group name and GID. In FreeBSD, the kernel uses the UID of a process, and the list of groups it belongs to, to determine what the process is allowed to do. Most of the time, the GID of a user or process usually means the first group in the list.

The group name to GID mapping is listed in `/etc/group`. This is a plain text file with four colon-delimited fields. The first field is the group name, the second is the encrypted password, the third the GID, and the fourth the comma-delimited list of members. For a more complete description of the syntax, refer to group(5).

The superuser can modify `/etc/group` using a text editor. Alternatively, pw(8) can be used to add and edit groups. For example, to add a group called `teamtwo` and then confirm that it exists:

Example 14-7. Adding a Group Using pw(8)

    # pw groupadd teamtwo
    # pw groupshow teamtwo
    teamtwo:*:1100:

In this example, `1100` is the GID of `teamtwo`. Right now, `teamtwo` has no members. This command will add `jru` as a member of `teamtwo`.

Example 14-8. Adding User Accounts to a New Group Using pw(8)

    # pw groupmod teamtwo -M jru
    # pw groupshow teamtwo
    teamtwo:*:1100:jru

The argument to `-M` is a comma-delimited list of users to be added to a new (empty) group or to replace the members of an existing group. To the user, this group membership is different from (and in addition to) the user's primary group listed in the password file. This means that the user will not show up as a member when using `groupshow` with pw(8), but will show up when the information is queried via id(1) or a similar tool. When pw(8) is used to add a user to a group, it only manipulates `/etc/group` and does not attempt to read additional data from `/etc/passwd`.

Example 14-9. Adding a New Member to a Group Using pw(8)

    # pw groupmod teamtwo -m db
    # pw groupshow teamtwo
    teamtwo:*:1100:jru,db

In this example, the argument to `-m` is a comma-delimited list of users who are to be added to the group. Unlike the previous example, these users are appended to the group list and do not replace the list of existing users in the group.

Example 14-10. Using id(1) to Determine Group Membership

    % id jru
    uid=1001(jru) gid=1001(jru) groups=1001(jru), 1100(teamtwo)

In this example, `jru` is a member of the groups `jru` and `teamtwo`.

For more information about this command and the format of `/etc/group`, refer to pw(8) and group(5).

Prev | Home | Next
Limiting Users | Up | Security