Groups are how Linux shares access between users. Creating one is a root task and a single command:
sudo groupadd developersThat adds a line to /etc/group. Confirm it and you are done:
A group on its own does nothing useful until it has members and owns (or is granted access to) some files. The point of a group is to let several users share access to the same resources without making those resources world-readable.
Add users to the group
Membership is set with usermod, not groupadd. The -a (append) is critical:
sudo usermod -aG developers deploy-aG adds developers to the user's existing secondary groups. Leaving out -a (usermod -G developers deploy) replaces all of the user's secondary groups with just developers, which is a classic way to accidentally remove someone from sudo or docker. There is a whole article on doing this safely.
Primary vs secondary groups
This trips up a lot of people.
| Primary group | Secondary groups | |
|---|---|---|
| How many | Exactly one per user | Zero or more |
| Set with | useradd -g / usermod -g | useradd -G / usermod -aG |
| Used for | The group new files get by default | Extra access (docker, sudo, shared dirs) |
| Listed in | /etc/passwd (the GID field) | /etc/group member lists |
When deploy creates a file, it is owned by deploy's primary group. Adding deploy to developers as a secondary group lets it read and write developers-owned files, but new files it creates still belong to its primary group, unless the directory has the setgid bit.
A shared project directory, end to end
The common real task: a folder several people can work in.
sudo groupadd developers
sudo usermod -aG developers alice
sudo usermod -aG developers deploy
sudo mkdir /srv/project
sudo chown root:developers /srv/project
sudo chmod 2775 /srv/project # 2 = setgid: new files inherit the groupThe leading 2 (setgid) makes every file created in /srv/project belong to developers automatically, so the whole team keeps access. Members must log out and back in for new group membership to take effect.
FAQ
See also
- How to Create a User on Linux: create the accounts you put in the group.
- How to Add a User to a Group: the usermod -aG details and the -a trap.
- setuid, setgid, and the sticky bit: make shared directories keep their group.
- Linux file permissions explained: the rwx model groups plug into.
Sources
Authoritative references this article was fact-checked against.
