Linux · users & permissions

chgrp

which group is it shared with

chgrp changes the group recorded on a file. The middle three permission bits apply to that group, so changing it decides which set of users the file is shared with. Unlike changing the owner, you can do it without root — for a file you own, to a group you belong to.

The owner is one person; the group is how a file is shared with a team.

Changes

The group only

the owner is untouched

Without root

Yes, if you own it

and belong to the new group

Whole tree

-R

recursive

Same as

chown :group

either works

At the terminal

Read the session first, then the notes: each numbered line in the output is answered by the note with the same number.

user@netflow — bashcoreutils

$ chgrp -v developers report.txt

1changed group of 'report.txt' from user to developers

$ ls -l report.txt

2-rw-r--r-- 1 user developers 2048 Sep 30 10:40 report.txt

3$ chgrp -R developers project/

$ chgrp admin report.txt

4chgrp: changing group of 'report.txt': Operation not permitted

Illustrative session · names, sizes and dates are examples, and every address is from a documentation or private range

Reading the output

What the numbered lines are telling you

-v reports what changed

The group was the user’s own private group; it is now developers. Without -v, chgrp prints nothing when it succeeds.

The fourth column is the group

The owner, in the third column, is still user. The permission bits did not change either — only which group the middle "r--" applies to.

-R changes a whole tree

Every file and directory under project/ is given to the developers group in one command.

Only to a group you are in

This user is not a member of admin, so the kernel refuses. Root can set any group; "id" shows which groups you belong to.

Switches

A switch changes how the command behaves. These are the ones used day to day; man chgrp lists the rest. Single-letter switches can usually be joined, so -l -a may be written -la.

-R: Recursive: change a directory and everything beneath it.
-v: Verbose: print a line for every file processed.
-c: Changes: print a line only for the files that were actually changed.
-h: Change a symbolic link itself, not the file it points to.
-f: Quiet: suppress most error messages.
--reference=FILE: Copy the group from another file instead of naming one.

Variations worth knowing

The same tool, pointed at a narrower question. These four cover most of what it is reached for day to day.

id

Lists the groups you belong to — the ones you may give a file to.

sudo chgrp -R www-data /var/www/site/uploads

Gives a directory tree to the web server’s group.

chgrp --reference=a.txt b.txt

Gives one file the same group as another.

chmod g+w report.txt

The usual next step: let the new group write to the file as well as read it.

In cybersecurity

A group is a list of people who all receive the same access, so the group on a file is only as careful as its membership.

Know who is in the group

Giving a file to a group gives it to every member, present and future. "getent group developers" lists them; review it before sharing anything sensitive.

Group write is nearly ownership

A member of a group with write access to a script that root runs can change what root runs. Check group-writable files on anything executed with privilege.

Powerful system groups

Membership of docker, sudo, wheel or disk is close to being root. Handing files to those groups, or adding users to them, should be deliberate.

Filed under

Users & permissions

Read alongside

chownChanges which user and which group own a file or directory.chmodChanges the permission bits on a file or directory — who may read it, write to it, and execute it.