[SOLVED] How am I a member of groups such as 'floppy', 'audio', and 'scanner'?

ratfactor · 08-29-2020, 11:12 AM

I'm puzzled by this behavior of coreutils groups output:

Code:

dave@europa~$ groups dave
dave : users wheel

dave@europa~$ groups
users lp wheel floppy audio video cdrom scanner

Why does the current process belong to more groups than my user?

The two groups I'd expect from the explicit membership in /etc/passwd and /etc/group are users (primary) and wheel (supplementary):

Code:

dave@europa~$ grep dave /etc/group
wheel:x:10:root,dave

dave@europa~$ grep dave /etc/passwd
dave:x:1000:100:,,,:/home/dave:/bin/bash

I understand that running groups on its own gives me the group membership of the current process (inherited from my login shell). But I am not understanding the mechanism by which I'm being added to the additional "system" groups (lp floppy audio video cdrom scanner).

Commands such as getent and id tell me things I already know:

Code:

dave@europa~$ getent group floppy users wheel
floppy:x:11:
users:x:100:
wheel:x:10:root,dave

dave@europa~$ id dave
uid=1000(dave) gid=100(users) groups=100(users),10(wheel)

dave@europa~$ id
uid=1000(dave) gid=100(users) groups=100(users),7(lp),10(wheel),11(floppy),17(audio),18(video),19(cdrom),93(scanner)

My research has led to the source code of GNU coreutils groups, the man pages for NSS and nsswitch.conf, etc. I've read the relevant chunks from Michael Kerrisk's The Linux Programming Interface (which I thought would surely scare the problem into revealing itself!).

Now I'm convinced I'm overlooking a super simple and obvious answer to this.

(As an amusing aside, I've noticed that all examples online carefully avoid this issue entirely.)

hazel · 08-29-2020, 11:54 AM

Look in the file /etc/login.defs. There is often a list of groups that the login program adds everyone to.

ratfactor · 08-29-2020, 12:22 PM

Quote:

Originally Posted by hazel

Look in the file /etc/login.defs. There is often a list of groups that the login program adds everyone to.

That's it! I'd even skimmed man login and man login.defs (described as "Shadow password suite configuration"), but had missed CONSOLE_GROUPS.

Code:

$ grep floppy /etc/login.defs 
CONSOLE_GROUPS         floppy:audio:cdrom:video:lp:scanner

After the fact, I also realized I probably could have found it like so with The Silver Searcher:

Code:

$ sudo ag floppy /etc | ag cdrom
/etc/login.defs:374:CONSOLE_GROUPS         floppy:audio:cdrom:video:lp:scanner

Thanks, Hazel!