A user's groups are stored in two places, and different usermod options change them.
There is one primary group: its GID is written in the user's line in /etc/passwd. The user's new files get it. Supplementary groups are listed in the file /etc/group: the last field of each group's line lists its supplementary members.
sudo:x:27:student — student belongs to sudo as a supplementary member. student's own primary group is not in this field: it is recorded in student's line in /etc/passwd.
usermod option |
What it changes |
|---|---|
-g group |
the primary group |
-G group1,group2 |
the whole list of supplementary groups, replacing it entirely |
That is why -G lab-writers left labmember with lab-writers as the only supplementary group, while the primary group labmember did not change.
In /etc/passwd ann has GID 1005. Does she belong to the devs group?
$ getent group devs
devs:x:1005:-
Membership is already recorded in the account: GID 1005 in ann's line makes devs her primary group. No login is needed for that.
-
The last field lists supplementary members. The primary group is set by the GID in
/etc/passwd, and ann's is 1005, the number of devs. -
An empty last field just means there are no supplementary members. Primary members are found by the GID in
/etc/passwd, and ann's is 1005.
The primary group is recorded in the user's line in /etc/passwd, while /etc/group lists supplementary members. So ann is in devs although the group's line does not name her; id ann shows gid=1005(devs).
Key points
-
The primary group is the GID in the
/etc/passwdline; supplementary ones are in the last field of/etc/grouplines. -
usermod -Gsets the whole supplementary list anew;-gchanges the primary group.