Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm having trouble configuring things on linux so that a program can access certain files. Let's call it pgm A. It has uid uA and gid gA. In addition, uid uA is listed in /etc/group as a member of group gX. The problem is that pgm A cannot access files for which the uid is root and the gid is gX, but only when pgm A is called from another program, pgm B, which also runs as user uA.

If I su as user uA and run pgm A from bash, it has no problem accessing files in group gX.

But if another program, pgm B, which also runs as user uA, forks and execs pgm A, pgm A cannot access the files. I've verified that pgm A is indeed running as user uA, group gA, when launched from pgm B. So, if uA is a member of group gX, why can't the program access files which are readable by group gX? It's as if the operating system is ignoring the fact that user uA is also in group gX.

share|improve this question

migrated from Nov 25 '11 at 9:24

This question came from our site for professional and enthusiast programmers.

This is not a programming question as much as it is a Linux super-user question. – Gray Nov 24 '11 at 21:29

You may need to login again after adding the user to the group, as group permissions are only read on login time.

share|improve this answer
Plus, Pgm B must have logged in the same way, without dropping group privileges. Do NOT think as if the user belongs to the groups. Think of it as "the user is added to these groups during login". If an application is started via setuid/setgid, I believe it does NOT get all the groups from the user, but it either keeps the groups it has (not setgid) or gets the group the app is (setgid). – user1060350 Nov 24 '11 at 21:51
Thanks. I had assumed that supplementary group assignments were inherent to a uid. But as you explain, they need to be added explcitly at some point during the launch of a process. – msidell Nov 25 '11 at 14:56
My pgm A is launched, indirectly, by Bernstein's tcpserver, which does a setuid() and setgid() for itself (and for its subprocesses), but does not do a setgroups(). I could solve my particular problem either by patching tcpserver to also do a setgroups(), or to rearrange some file rights to allow by program to access the files it needs without requiring supplementary group assignments. Thanks for helping me understand how group assignments work. – msidell Nov 25 '11 at 15:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .