Linux Users, Groups, and Permissions

Linux makes access decisions for processes, not for names typed at a login prompt. Each process carries credentials that include user IDs, group IDs, and supplementary groups. Filesystem objects carry an owner user ID, an owner group ID, and a mode. The kernel compares the process credentials with that metadata when it checks ordinary discretionary access.

Account names make numeric identities usable for people and administrators. A local /etc/passwd entry maps a login name to a user ID, primary group ID, home directory, and login shell. The public account record normally contains an x in its password field. Password hashes reside in /etc/shadow, which has tighter access. Local groups are described in /etc/group, while the Name Service Switch can resolve users and groups from local files or configured services.

This distinction matters during troubleshooting. A username is a label resolved by user-space libraries. Ownership stored on a filesystem is numeric. If a directory service becomes unavailable, a file still has the same numeric owner, even when tools cannot display the corresponding name. Reusing a user ID can therefore give a new account access to files owned by the old identity.

Process credentials and group membership

A process has real and effective user and group IDs. The effective IDs usually drive permission checks. A process also has a supplementary group list. Login and session setup establish these credentials, and child processes inherit them. Changing a user's group database entry does not rewrite credentials already held by running sessions; a new login or an appropriate session refresh is normally required.

Linux Users, Groups, and Permissions

Process credentials and group membership

Relevant careers