Linux Labs

Users, permissions, and processes / Stage 7 of 13

Managing group membership

Not running Starting usually ~20 s
Leave the lesson

Step 4 of 6 · on a machine · 6 min

The account changed, the process did not

A running process's groups are its own list, and usermod does not touch it. You can see this on a program that was running before the change.

labmember already has a process running: sleep, started as him, the way his service or an open terminal would run. Add a group to labmember and compare the account with that process. ps prints a process's groups in the SUPGRP column.

Exercise · look

The groups of a running program

Add labmember to lab-writers, then compare the account's groups with those of labmember's process that is already running.

First, predict

Which supplementary groups will labmember's running sleep have after usermod -aG lab-writers?

Now start the exercise, run the command and compare your prediction with the output.

Sign in and start The machine is available after signing in

The process got its group list when it started and has not reread it since. usermod changes the record in /etc/group, and processes already running live with the old list. Processes started after the change get the new list: a new login, or sudo -u labmember.

The same goes for removal: a removed group stays with running processes until they are restarted. So you check both granting and removal with a fresh process: sudo -u user id.

Ubuntu 24.04
Loading…