How the Linux Group File Manages User Permissions

In the Linux operating system, the /etc/group file serves as the central registry for user groups, defining how shared access rights and permissions are distributed among multiple accounts. Instead of assigning individual permissions for every user on a system, administrators use this file to organize users into logical units that share common access rights to files, directories, and system resources. This article explains the structure of the /etc/group file, how group-based file permissions work, and how the operating system evaluates group membership to enforce security boundaries.

The Structure of the /etc/group File

The /etc/group file is a plain-text file where each line represents a single group. Each entry is divided into four colon-delimited fields:

group_name:password:GID:user_list

Group Name: The human-readable identifier for the group (e.g., developers, sudo, or docker).
Password: Historically used to store an encrypted group password. In modern systems, this is represented by an x, indicating that shadow passwords stored in /etc/gshadow are used if a password exists, or that no password is required.
Group ID (GID): A unique numerical value that the Linux kernel uses internally to track the group. GID 0 is reserved for root, system groups typically occupy lower numbers (often 1–999), and standard user groups start at 1000 or higher.
User List: A comma-separated list of usernames that belong to the group as supplementary members.

Primary vs. Supplementary Groups

Linux categorizes group memberships into two types:

Primary Group: Stored in the /etc/passwd file rather than the member list in /etc/group. When a user creates a new file or directory, the item automatically inherits the user's primary GID as its group owner.
Supplementary (Secondary) Groups: Explicitly listed in the fourth field of /etc/group. A user can belong to multiple supplementary groups. These memberships allow users to access files and services owned by groups other than their primary group.

How the Linux Kernel Evaluates Permissions

Linux uses standard Discretionary Access Control (DAC) to regulate file access. Every file and directory on the system is associated with three permission categories:

User (u): The specific user who owns the file.
Group (g): The group that owns the file.
Others (o): All other users on the system.

Each category can have Read (r), Write (w), and Execute (x) permissions.

When a user attempts to interact with a file, the Linux kernel determines access permissions in a strict order:

Owner Check: If the user’s User ID (UID) matches the file owner's UID, the kernel applies the User permissions and stops checking further.
Group Check: If the user is not the owner, the kernel checks whether the file's owning GID matches the user's primary group or any of the supplementary groups defined in /etc/group. If a match is found, the kernel applies the Group permissions and stops checking.
Others Check: If neither the user nor any of their groups match, the Others permissions are applied.

Multi-User Collaboration Through Group Permissions

The /etc/group file allows system administrators to grant identical access levels to multiple users without altering permissions for the rest of the system.

For example, to provide three users (alice, bob, and charlie) with read and write access to a shared project directory:

An administrator creates a group entry in /etc/group:
```
project_dev:x:1005:alice,bob,charlie
```
The shared directory's ownership is assigned to that group:
```
chgrp project_dev /var/shared/project
```
The directory permissions are set to allow group read, write, and execute access:
```
chmod 770 /var/shared/project
```

Because alice, bob, and charlie are mapped to GID 1005 in /etc/group, the kernel matches their group access rights, allowing all three to collaborate within /var/shared/project while preventing unauthorized users from reading or altering the directory contents.