25

After I edit /etc/group and I add a user to groups it didn't belong to, the user will not be able to use it's newly acquired privileges unless it starts a new session.

Is there a command to refresh user/group properties in an ongoing session?

3
  • 1
    Is there a reason you're editing the file by hand instead of using useradd -G groupname username?
    – Bobby
    Jun 15, 2010 at 8:28
  • 5
    @Bobby: this would make no difference.
    – niXar
    Jun 15, 2010 at 10:09
  • You might look this answer.
    – Pablo A
    Jul 23, 2017 at 17:22

3 Answers 3

16

At the kernel level, group membership is a property of each process. Unless it has the appropriate capability (CAP_SETGID if I'm not mistaken), i.e. root privileges for all intents and purposes, a process cannot belong to a new group.

A user does not exist as an object at the kernel level; only processes (and files) do. A process has a uid (effective and whatnot) and a list of group ids.

When you are adding a user to a group, the kernel has no idea what it means. It only knows, indirectly, that the next time /bin/login or /usr/bin/newgrp is run a process with that user id will have a new group id in its list.

So, to answer your question, if you're speaking of a Gnome or KDE session, you have to restart it indeed. Or if you only care about the result of one command as far as that new group is concerned, you can use newgrp I just mentioned. It will start a new shell with the newly added group.

5

I've read before that the newgrp command does this, but only for the current shell. There doesn't seem to be a better alternative than to log out and back in again.

1
  • 4
    What newgrp does is actually start a new shell. So if you ^D from it you're back to your old shell. I usually simply do 'exec newgrp'
    – niXar
    Jun 15, 2010 at 10:08
0

exec sg <newGroup> newgrp e.g. exec sg sudo newgrp

This will replace your current shell with a new shell which has an updated/refreshed list of secondary groups (this is the same effect as logging out and logging back in again).

If you scour Stack Exchange, you will see many suggestions to use newgrp (without wrapping it in sg) - this approach modifies the user's primary group which will adversely affect the group ownership of any files created during this shell session.

See here for more info.

You must log in to answer this question.