Linux – In `/etc/passwd`, can different usernames for the same user ID have different group IDs

grouplinuxusers

From The Linux Programming Interface, about /etc/passwd:

It is possible (but unusual) to have more than one record in the
password file with the same user ID, thus permitting multiple login
names for the same user ID. This allows multiple users to access
the same resources (e.g., files) using different passwords. The
different login names can be associated with different sets of
group IDs.

Group ID (GID) field is the numeric ID of the first of the groups of which this user is a member. Further group memberships for this
user are defined in the system group file.

about /etc/group:

User list field is a comma-separated list of names of users who are members of this group. (This list consists of usernames
rather than user IDs, since, as noted earlier, user IDs are not
necessarily unique in the password file.)

In /etc/passwd,

  • does the group ID field depend on user name or on user ID?

  • In other words, can different usernames for the same user ID have different group IDs, or must all the usernames for the same user ID have the same group ID?

Thanks.

Best Answer

The key in the user database, /etc/passwd or something else, is the login name: that’s all that you provide to identify yourself when you log in. From that key, a program can retrieve all the other information stored in the user database; this happens with no regard for any other user in the user database, even other users with the same user id. (Typically, this is done with getpwnam or getpwnam_r, either directly or via PAM.)

Thus the login name leads to the stored password, the user id, the (primary) group id, the GECOS information, the home directory and shell. This means that two users can share the same user id, yet have different home directories and shells! (This was commonly used in the past to provide a fall-back, statically-linked shell for root; you’d have the usual root user with id 0 and shell /bin/bash or whatever, and another user, say sashroot, with id 0 and a different shell.)

Hence the answer to

does the group ID field depend on user name or on user ID?

is that it depends only on the user name.

The key in the group database is also the group name. From that key, a program can retrieve all the other information stored in the group database; again this happens with no regard for any other group in the group database. (When determining a user’s secondary groups, the process is more complex than reading the user database: there is no function to list groups to which a given user belongs, so this is typically done in a loop involving getgrent and endgrent.)

Thus the group name leads to the group password, group id, and the list of group members, which is a list of user names. To build a user’s set of secondary groups, all the groups are enumerated, and the user’s login name is matched against the group’s members. So not only can two different users with the same user id have different primary groups, they can belong to a different set of secondary groups!

Hence the answer to

In other words, can different usernames for the same user ID have different group IDs, or must all the usernames for the same user ID have the same group ID?

is that a user’s groups only depend on the user name, and different user names can share a user id yet have different primary and secondary groups.

Related Question