2

I've been wondering if there is a good reason why a regular user can't create their own group. It would make sense for the file owner to be able to set up a group and manage file permissions. For instance a user could allow only their close friends on the system to read their home folder, so they set up their own group to manage file permissions to files for which they have ownership.

Is there a security concern I'm not seeing here? I don't see why the sysadm has to maintain all groups on the system.

Improve this question
0

2 Answers 2

Reset to default
1

Groups are a system-wide resource that are stored in a single file owned by root. The current group format makes no distinction between "user" and "system" groups other than GID range, and even if it did, it has no way of granting access to portions of the file to different people. Because of this, you would have to come up with a new system to allow non-administrators to add and remove groups without giving full access via sudo and equivalents. There apparently hasn't been enough demand for this feature (likely because Unix installations were originally institutional), but there was enough demand to implement a related feature.

You can delegate a user to be able to modify group membership using gpasswd. If you give a user administrative control over a group, they can then add or remove members without having to have root access (by default, there is no group administrator, so only root can make changes.) Given the following (as root):

# groupadd newgroup # gpasswd -A owner -M member1,member2 newgroup

The user owner can now modify the group newgroup without having to get any other permissions:

$ gpasswd -a member3 newgroup Adding user member3 to group newgroup

(You'll notice that the group administrator doesn't actually have to be a member.)

Improve this answer
0

Imagine the madness that would ensue if any and all users could create whatever groups they wanted. To add to it, would you permit the users to add whomever they wanted to the groups? That would be a royal pain for a system admin to account for. It's called the principal of least privilege. There is no reason for regular users who may not and probably don't have the proper understanding of how things work to be able to create and add others to groups which is especially true at the enterprise level for any operating system.

It's the same reason that regular end users aren't allowed to change system settings or install software.

Improve this answer
4
  • 1
    I can't imagine any madness tbh. Users already posess ownership of their files, meaning they can, at the very least, give blanket file permissions for every user on the system. Allowing a user to manage their own groups would allow them to assign file permissions to users of their choosing, which isn't really a boost in privileges in terms of the possible mayhem they may cause. Could you give me an example of the madness that you speak of? Commented Mar 16, 2018 at 1:59
  • You just answered it for yourself. The users can already give access to their own files to any other user on the system so there is no reason for them to be able to create groups and add members to them. It would be extremely difficult for system admins to keep track of all of those groups and the members belonging to them if any user could create them and add members to them. That is enough to explain why regular end users aren't allowed to do those things. Commented Mar 16, 2018 at 2:07
  • In an enterprise environment, the authentication would take place via ldap anyway and you can rest assured that no one is going to give normal end users access to the ldap servers. There is no good reason for end users to be able to be able to mess with things that they don't understand and the fact that you need to ask should answer your question. Commented Mar 16, 2018 at 2:11
  • Yes, now that you mention it, file owners are able to edit the acl, so that solves the problem. Commented Mar 16, 2018 at 2:22

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.