UC San Diego SearchMenu

Using Groups Within Unix

What are groups? How do instructors and TAs use them?

The concept of groups in Unix is related to the permissions placed upon files and directories-- that is, who gets to read, write, or execute your files, or search through or write to your directories. The Unix group facility allows a set of accounts to be identified as a group. Members may then set permissions on files and directories to share access with other members of the group. If you do not own a file but belong to the group which it is owned by, then you are granted group access to the file.

The "groups" command shows the groups to which you or the optionally specified user belong. Each user belongs to a group specified in the password file /etc/passwd and possibly to other groups as specified in the file /etc/group. This file may not exist on an workstation. To view it on a workstation, use "ypcat group".

Groups created for classes have the same group name as the instructor's own class account (for example, "ee101f"). The members of this group can only be the instructor and the TAs for that class. The members of this group can then act as class administrators, so that it is possible for only the members to modify a class broadcast file readable from the class but not changeable, or to make new files available or to edit and change class files.

Setting up group access for existing files

It is first necessary to have a "superuser" put an entry into the file /etc/group for you (instructors should contact theAccount Services Office). In a workstation environment, the entries may reside on an NIS server and may not appear in the /etc/group file local to the workstation. This file can be viewed from a workstation using the command "ypcat group".

Once you and your partners have been entered as a group into the /etc/group file, there are two steps to allowing access to each other's files. These steps are:

  1. "chgrp" currently-existing files and directories you own, so that they are in the group
  2. "chmod" currently-existing files and directories you own, so that they are accessible to your group in the manner you desire.
Step 1: Using "chgrp" to make files and directories belong to the group

Syntax for using the "chgrp" command is as follows:

chgrp <groupname> <file-or-directory> ...

as in:

chgrp duckbills *.*

This example will (assuming the user belongs to the group "duckbills") change the group-name of all files and subdirectories (but not the files in those sub-directories) in the current directory, as well as the current directory itself, to the group "duckbills".

Every directory leading to the files that you want to share must allow at least "x" permission for the group members, and more commonly would allow "r" permission as well.

Usually, filesystems are typically configured so that when you create a new file or sub-directory, the new object inherits the group identity of the parent directory.

Step 2: Using "chmod" to place group access on existing files and dirs

Use the chmod program to modify the access-privileges of your files and directories., or check the chmod manpage for details.

For more information, see the man pages on the following: groups(1), setgroups(2), chgrp(1), chmod(1), ls(1), csh(1) umask(2)

Setting up group access for new files

It is first necessary to have a "superuser" put an entry into the file /etc/group for you (instructors should contact the Account Services Office at 534-4060, acs-consult@ucsd). In a workstation environment, the entries may reside on an NIS server and may not appear in the /etc/group file local to the workstation. This file can be viewed from a workstation using the command "ypcat group".

There are two steps that should be taken to ensure that files you create in a directory have the correct group information and will be accessible to others in your group.

  1. change the "umask" value in your ".cshrc" file so that new files will have the desired access permissions

  2. use the set-group-id bit on the directory where your group files are stored.

    or

    use the newgrp command to create a shell with a specified default group. You'll still want to use "umask".

Step 1: Changing the "umask" value in your ".cshrc" file

When files are created, the default access privileges associated with them are defined by the C-shell's built-in "umask" command. What you need to do is determine what access privileges you want your group and others to have by default). The following octal values represent the sets of designated file permissions most commonly used as values for "umask" with respect to groups: (see the man pages for chmod(1) for specifics)

  • 027 – group read and execute, no access for others
  • 022 – read and execute access for group & others
  • 002 – group members have all access, others have read & execute
  • 007 – group members have all access, no access for others

Once you know the value you want put the "umask" command in your .cshrc file with the value as argument:

umask 027

Check your .login file to make sure that no other umask command is contained there.

Note that "umask" only defines the default maximum access to a file or directory, which you can always override (to allow either more or less access to any given file or directory) with a chmod (change mode) command; see chmod(1).

Step 2: Creating a directory that defaults to particular group

To create a directory for a group project beneath your home directory that uses the setgid bit:

  1. create the directory:
    mkdir ~/ourproject
  2. change the group ownership of the directory
    chgrp ourgroup ~/ourproject
  3. change permissions on the directory:
    chmod g+rwxs ~/ourproject
  4. make sure others can access (but not read) your home directory
    chmod a+x ~
  5. any files created in that directory will belong to "ourgroup".
Step 2 (alternate)--Using newgrp to change your default group

Use the newgrp command to change your default group. A new shell is created with a different default group. The newgrp command may not be available on some systems. Type "man newgrp" for more information. To set up a group project directory beneath your home directory for use with newgroup:

  1. create the directory:
    mkdir ~/ourproject
  2. change the group ownership of the directory
    chgrp ourgroup ~/ourproject
  3. change permissions on the directory (note: no 's'):
    chmod g+rwx ~/ourproject
  4. make sure others can access (but not read) your home directory
    chmod a+x ~
  5. run newgrp to change your default group.
    newgrp ourgroup
  6. any files you create will now be belong to "ourgroup".