id shows how the kernel sees a process: a user number and group numbers.
The shell in your terminal was started at login as student, and every command launched from it gets the same account — that is how cat ran at the start of the lesson. The summary's directory plays no part in the check: the kernel looks at the process and at the file itself.
The kernel stores a process's account as numbers. The UID (user identifier) is the user's number, the GID (group identifier) is a group's number. Names like student and root are for people; the kernel compares numbers.
root has UID 0. An ordinary user's number is assigned when the account is created and can differ between machines.
Besides a user, a process has groups. A group gathers accounts for shared access: for example, every member of reports may read the summaries.
A process has one primary group, whose number is its GID. It can have several supplementary groups. The kernel takes all of them into account when it checks access.
id prints everything at once, for example uid=1000(student) gid=1000(student) groups=1000(student),27(sudo): the UID, the primary group, and the group list, each as a number and a name. id root describes another account.
A process gets its group list from the process that started it and never refreshes it. A login and sudo -u read it from the account again when they start a new process. That is why two similar commands can print different things:
| Command | What it describes | When a new group shows up |
|---|---|---|
id |
the current process, your shell | after a new login |
id student |
the account as it is recorded now | right after you are added |
Members of the reports group may read the summary. You have just been added to reports. In the same terminal you start a new shell with bash and run cat summary.txt in it. What happens?
-
A
bashstarted from the old shell inherits that shell's group list. Runidin it and reports is not in the list. -
A group password is an old, rarely used
newgrpfeature; a group member does not need it. The refusal comes from the shell's group list:idshows it without reports. -
cdchanges only the shell's current directory; the groups stay the same. Compareidbefore and aftercd: the output is identical.
The new shell is a process started from the old one, so it inherits that shell's group list. id in it shows the old groups, while id student already lists reports. A fresh login brings the new list.
Key points
- The kernel tells users and groups apart by number, UID and GID; names are for people.
- A process has one primary group and may have supplementary ones; access is checked against all of them.
-
A process inherits its group list when it starts; a login and
sudo -uread it from the account again.