etc/group - current time (not to be confused with --Current)

Jeebizz · 03-18-2023, 09:25 PM

In the context of 15.0 and whatever next version is coming up if 15.1 - assuming not 16 and not relating to --Current, what should be recommended groups to be part of these days? This is what I have, and what should I remove?

-edit

Also I am the only user on this machine, no other accounts. I never bothered to add myself to wheel only because I have also been just too lazy to configure sudo. Also some are force of habit from decades ago, like adding my username to audio, and video, cdrom.

Code:

root:x:0:root
bin:x:1:root,bin
daemon:x:2:root,bin,daemon
sys:x:3:root,bin,adm
adm:x:4:root,adm,daemon
tty:x:5:
disk:x:6:root,adm
lp:x:7:lp
mem:x:8:
kmem:x:9:
wheel:x:10:root
floppy:x:11:
mail:x:12:mail
news:x:13:news
uucp:x:14:uucp
man:x:15:
dialout:x:16:uucp
audio:x:17:root,pulse,slackuser
video:x:18:sddm,slackuser
cdrom:x:19:slackuser
games:x:20:slackuser
slocate:x:21:
utmp:x:22:
smmsp:x:25:smmsp
tape:x:26:
mysql:x:27:
rpc:x:32:
sshd:x:33:sshd
cgred:x:41:
gdm:x:42:
shadow:x:43:
ntp:x:44:
icecc:x:49:
ftp:x:50:
oprofile:x:51:
named:x:53:
sddm:x:64:slackuser
pulse:x:65:slackuser
dhcpcd:x:68:
input:x:71:slackuser
apache:x:80:
messagebus:x:81:slackuser
haldaemon:x:82:slackuser
plugdev:x:83:slackuser
power:x:84:slackuser
netdev:x:86:
polkitd:x:87:slackuser
pop:x:90:pop
postfix:x:91:
postdrop:x:92:
scanner:x:93:
dovecot:x:94:
dovenull:x:95:
nobody:x:98:nobody
nogroup:x:99:
users:x:100:slackuser
console:x:101:slackuser
burning:x:102:slackuser
ldap:x:330:
vboxusers:x:999:slackuser

Daedra · 03-19-2023, 03:30 PM

I don't usually add myself to wheel either, or mess with configuring sudo. I just create the file /etc/sudoers.d/daedra with...

Code:

daedra ALL=(ALL) NOPASSWD: ALL

Jeebizz · 03-19-2023, 03:45 PM

Quote:

Originally Posted by Daedra

I don't usually add myself to wheel either, or mess with configuring sudo. I just create the file /etc/sudoers.d/daedra with...

Code:

daedra ALL=(ALL) NOPASSWD: ALL

I see.

I am rather surprised nobody commented on some of the groups I added myself, so I'll go ahead and ask - should I even be part of the listed groups?

Code:

audio:x:17:root,pulse,slackuser
video:x:18:sddm,slackuser
cdrom:x:19:slackuser
games:x:20:slackuser
sddm:x:64:slackuser
pulse:x:65:slackuser
input:x:71:slackuser
messagebus:x:81:slackuser
haldaemon:x:82:slackuser
plugdev:x:83:slackuser
power:x:84:slackuser
netdev:x:86:
polkitd:x:87:slackuser
nogroup:x:99:
users:x:100:slackuser
console:x:101:slackuser

henca · 03-20-2023, 01:45 AM

Usually you add users to a group because those users need some permission. I would say that adding users to groups is mostly a far better solution than to use sudo or su to get those permissions. That said, I don't think Daedra suggested to allways do things as root, only not to add normal users to the wheel group.

In your list of groups, I am not sure if you want to put a normal user in the sddm group. However, I can't say for sure as I don't use sddm myself.

regards Henrik

Petri Kaukasoina · 03-20-2023, 03:36 AM

Quote:

Originally Posted by henca

In your list of groups, I am not sure if you want to put a normal user in the sddm group.

The same with: games pulse input messagebus haldaemon polkitd console

The system groups are used to separate privileges.

For example the mouse device nodes are readable by group input. Whatever process needs to read mouse, is in group input (or is root). If you put yourself in group input, all your processes have direct access to the mouse. (In multi-user environment to other people's mice, too).

If you are in many system groups, it's almost the same as being root all the time.

Jeebizz · 03-20-2023, 09:58 AM

Right so clearly I do not have a firm grasp on this - maybe I really should remove myself from a few things. I do use sddm though , but I am unsure if I should still remove myself from that. Plugdev I assume is for anything USB? Also I remember back in the day there was a printer group, but no more - there is a scanner group - but I don't have a scanner. Should I also remove myself from polkitd? I probably incorrectly assumed polkit won't work / give an error if I am not there - for example if I launched gparted without being part of the polkitd group, it might error (which I am probably wrong in this assertion).

So yea, I feel that while Slackware has changed - some of the documentation hasn't quite changed with it. Should I still even be part of audio? And in this case, why is pulse its own thing, as well as in audio? And also how does pipewire work if whenever at some point Slackware moves to that as a default?

And so by this, I want to reiterate starting with version 15 and onwards , what SHOULD be recommended for groups? And to try to further simply the use-case , just for say a normal everyday desktop use, involving say even plugging in anything usb (storage, controllers(gaming), etc) ?

Video - same thing, should I still be part of video these days?

Petri Kaukasoina · 03-20-2023, 10:49 AM

Quote:

Originally Posted by Jeebizz

I do use sddm though , but I am unsure if I should still remove myself from that.

Yes, you should remove yourself from group sddm. Many system binaries run as special users/groups. You don't need to, yourself.

Quote:

Should I also remove myself from polkitd?

Yes, the same thing there: polkitd runs as user polkitd, group polkitd. You don't.

Quote:

if I launched gparted without being part of the polkitd group, it might error

Isn't gparted such a heavy-duty thing that you run it as root? Root does not need to be in any group, it can always do anything.

Quote:

what SHOULD be recommended for groups?

/usr/sbin/adduser script tells to press the UP arrow key to add/select/edit additional groups. And it proposes this list of "additional groups for desktop users": "audio cdrom floppy input lp netdev plugdev power scanner video". I am strongly against "input", because it gives all users read/write access to other users' mice. I don't use it. Maybe it's needed for games to access joystick?

brianL · 03-20-2023, 11:02 AM

Petri has beaten me to it, I was going to mention the up-arrow bit during the adduser routine. Here are my groups, I've recently started using sudo for a change, using these instructions.

Code:

brian@slackdesk:~$ id
uid=1000(brian) gid=100(users) groups=100(users),7(lp),11(floppy),17(audio),18(video),19(cdrom),71(input),83(plugdev),84(power),86(netdev),93(scanner),999(vboxusers),1000(sudo)

Jeebizz · 03-20-2023, 11:09 AM

Ok, and video? - Is that for X11 or is it for video devices such as capture cards and not related to video cards? As for gparted, I use it because sometimes I just feel that much more lazy; and I know it prompts you for a password, and thats where polkit comes in, hence why I added myself (mistakenly thinking I needed to be part of it).

I never add myself to floppy because well I don't even have a floppy drive, so I know I don't need to be part of that. I figured also eventually that should go away. In my case, I still like using optical media and I do still burn discs (blurays), so I need cdrom at least, and I do manually create the burning group since it is not there by default.

brianL · 03-20-2023, 11:20 AM

Quote:

Originally Posted by Jeebizz

Ok, and video? - Is that for X11 or is it for video devices such as capture cards and not related to video cards?

No idea.

Quote:

Originally Posted by Jeebizz

I never add myself to floppy because well I don't even have a floppy drive

Me neither, but I've left that as is, in case I ever get a portable floppy drive.

Petri Kaukasoina · 03-20-2023, 11:20 AM

I just booted to a clean 15.0 system with NO additional groups defined for me. And firefox (in X) showed me video with sound.

Jeebizz · 03-20-2023, 11:24 AM

Quote:

Originally Posted by brianL

No idea.

Me neither, but I've left that as is, in case I ever get a portable floppy drive.

But wouldn't that be through USB, thus needing maybe plugdev?

brianL · 03-20-2023, 11:30 AM

Quote:

Originally Posted by Jeebizz

But wouldn't that be through USB, thus needing maybe plugdev?

Yeah, most likely - but I'm in that, so I'm covered.
As Petri said:

Quote:

Originally Posted by Petri Kaukasoina

/usr/sbin/adduser script tells to press the UP arrow key to add/select/edit additional groups. And it proposes this list of "additional groups for desktop users": "audio cdrom floppy input lp netdev plugdev power scanner video".

chrisretusn · 03-20-2023, 11:41 PM

Interesting topic. This is what I have in my /etc/group as me.

Code:

lp:x:7:lp,chris
wheel:x:10:root,chris
floppy:x:11:chris
audio:x:17:chris,pulse,root
video:x:18:chris,sddm
cdrom:x:19:chris
plugdev:x:83:chris
power:x:84:chris
netdev:x:86:chris
scanner:x:93:chris
vboxusers:x:215:chris
wireshark:x:361:chris

My user name was added to these groups by 'adduser'. These are the "additional" groups added by adduser: "audio cdrom floppy input lp netdev plugdev power scanner video"

The only "stock" group I added myself to was wheel.

Recently I deleted four other users, leaving just me on this system. I took a look at an older backup. The listing is the same except of course the users are listed in the "stock" groups added to them by 'adduser' along with me. There is one exception, the "input" group. In the backup only the four users are listed. I am not listed. My guess is at one point "input" was added to the additional groups added by "adduser". I say this because this system is been around for a long time. The hardware is newer than the install. I just move the old install on to the new hardware. I have not done a "fresh" install in over 10 years. In checking the "adduser" script in the "shadow" source, I see the "input" was added (v1.16 - 2018-07-22) so it looks like I was correct.

I will be adding my self to this "input" group just for GP.

brianL · 03-21-2023, 08:59 AM

I've been looking into sudo group vs wheel group as far as granting root privileges with sudo goes. Apparently the sudo group method is a Debian/Ubuntu thing. And according to the Arch wiki, the wheel option might be preferable.

Quote:

Tip: When creating new administrators, it is often desirable to enable sudo access for the wheel group and add the user to it, since by default Polkit treats the members of the wheel group as administrators. If the user is not a member of wheel, software using Polkit may ask to authenticate using the root password instead of the user password.