1.\" $NetBSD: groups.7,v 1.8 2020/04/02 20:57:20 roy Exp $ 2.\" 3.\" Copyright (c) 2020 The NetBSD Foundation, Inc. 4.\" All rights reserved. 5.\" 6.\" Redistribution and use in source and binary forms, with or without 7.\" modification, are permitted provided that the following conditions 8.\" are met: 9.\" 1. Redistributions of source code must retain the above copyright 10.\" notice, this list of conditions and the following disclaimer. 11.\" 2. Redistributions in binary form must reproduce the above copyright 12.\" notice, this list of conditions and the following disclaimer in the 13.\" documentation and/or other materials provided with the distribution. 14.\" 15.\" THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 16.\" ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 17.\" TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 18.\" PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 19.\" BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 20.\" CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 21.\" SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 22.\" INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 23.\" CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 24.\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 25.\" POSSIBILITY OF SUCH DAMAGE. 26.\" 27.Dd April 2, 2020 28.Dt GROUPS 7 29.Os 30.\""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""" 31.Sh NAME 32.Nm groups 33.Nd standard group names 34.\""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""" 35.Sh DESCRIPTION 36A standard 37.Nx 38installation has the following user group names: 39.\" These are currently sorted by gid; perhaps they should be sorted 40.\" lexicographically by name instead. 41.Bl -tag -width ".Em _tcpdump" 42.It Em wheel 43Users authorized to elevate themselves to the super-user privileges of 44the root user, meaning uid\~0. 45Normally the 46.Em wheel 47group has gid\~0. 48.Pp 49Users who are not in the group 50.Em wheel 51are never allowed by 52.Xr su 1 53to gain root privileges. 54.It Em daemon 55Used by the set-group-id 56.Pq Xr setuid 7 57programs 58.Xr lpq 1 , 59.Xr lpr 1 , 60and 61.Xr lprm 1 . 62.\" Unclear why. Maybe used to be used by uucp stuff too, since 63.\" /var/spool/lock ownership is uucp:daemon? 64.It Em sys 65Historic group. 66Unused in modern 67.Nx . 68.It Em tty 69Used by the set-group-id 70.Pq Xr setuid 7 71programs 72.Xr wall 1 73and 74.Xr write 1 75to allow users to send messages to another tty even if they don't own 76it. 77Static tty device nodes in 78.Pa /dev 79are all in the group 80.Em tty , 81and the 82.Xr mount_ptyfs 8 83program passes the gid of the 84.Em tty 85group to the kernel so that all nodes in 86.Pa /dev/pts 87or equivalent are in the group too. 88.It Em operator 89Users authorized to take backups of disk devices and shut down the 90machine. 91.Pp 92The disk device nodes in 93.Pa /dev 94such as 95.Pa /dev/rwd0a 96are in the group 97.Em operator 98and group-readable so users in the group can read from disk devices, 99for example with 100.Xr dump 8 . 101The tape device nodes in 102.Pa /dev 103such as 104.Pa /dev/rst0 105are in the group 106.Em operator 107and are both group-readable and group-writable so users in the group 108can write to tape devices. 109.Pp 110The 111.Xr shutdown 8 112program is executable only by root and members of the 113.Em operator 114group. 115.It Em mail 116Historic group. 117Unused in modern 118.Nx . 119.\" Is this true? Hard to grep for this in src... 120.It Em bin 121Historic group. 122Unused in modern 123.Nx . 124.It Em wsrc 125Historic group. 126Unused in modern 127.Nx . 128.\" Actually it seems to be used in the set lists somehow, but it's 129.\" unclear to me how what the significance is. 130.It Em maildrop 131Used by the set-group-id 132.Pq Xr setuid 7 133programs 134.Xr postdrop 1 135and 136.Xr postqueue 1 137to submit to and examine the 138.Xr postfix 1 139mail queue at 140.Pa /var/spool/postfix/maildrop 141and 142.Pa /var/spool/postfix/public . 143.It Em postfix 144Primary group for the 145.Em postfix 146pseudo-user used by the 147.Xr postfix 1 148mail transfer agent. 149.\" Why are various subdirectories of /var/spool/postfix owned by 150.\" postfix:wheel and not postfix:postfix? 151.It Em games 152Used by various set-group-id 153.Pq Xr setuid 7 154games to maintain high-scores files and other common files in 155.Pa /var/games . 156.It Em named 157Primary group for the 158.Em named 159pseudo-user used by the 160.Xr named 8 161DNS nameserver daemon. 162.It Em ntpd 163Primary group for the 164.Em ntpd 165pseudo-user used by the 166.Xr ntpd 8 167network time protocol daemon. 168.It Em sshd 169Primary group for the 170.Em sshd 171pseudo-user used by the 172.Xr sshd 8 173secure shell daemon. 174.It Em _pflogd 175Primary group for the 176.Em _pflogd 177pseudo-user used by the 178.Xr pflogd 8 179log daemon with the 180.Xr pf 4 181packet filter. 182.It Em _rwhod 183Primary group for the 184.Em _rwhod 185pseudo-user used by the 186.Xr rwhod 8 187system status daemon. 188.It Em staff 189Staff users, in contrast to regular or guest users. 190Not used by 191.Nx ; 192available for the administrator's interpretation. 193.It Em _proxy 194Primary group for the 195.Em _proxy 196pseudo-user used by the 197.Xr ftp-proxy 8 198and 199.Xr tftp-proxy 8 200proxy daemons with packet filters such as 201.Xr pf 4 202or 203.Xr ipnat 4 . 204.It Em _timedc 205Primary group for the 206.Em _timedc 207pseudo-user used by the 208.Xr timedc 8 209tool to communicate with the 210.Xr timed 8 211time server daemon. 212.It Em _sdpd 213Primary group for the 214.Em _sdpd 215pseudo-user used by the 216.Xr sdpd 8 217Bluetooth service discovery protocol daemon. 218.It Em _httpd 219Primary group for the 220.Em _httpd 221pseudo-user used by the 222.Xr httpd 8 Pq bozohttpd 223web server. 224.It Em _mdnsd 225Primary group for the 226.Em _mdnsd 227pseudo-user used by the 228.Xr mdnsd 8 229multicast DNS and DNS service discovery daemon. 230.It Em _tests 231Primary group for the 232.Em _tests 233pseudo-user used by 234.Xr atf 7 235automatic tests that request to run unprivileged. 236.It Em _tcpdump 237Primary group for the 238.Em _tcpdump 239pseudo-user used by the 240.Xr tcpdump 8 241network traffic dumper and analyzer. 242.It Em _tss 243Primary group for the 244.Em _tss 245pseudo-user used by the 246.Xr tcsd 8 247.Sq Trusted Computing 248daemon to manage a TPM. 249.It Em _gpio 250Users authorized to read and write GPIO pins; see 251.Xr gpio 4 252and 253.Xr gpioctl 8 . 254.It Em _dhcpcd 255Primary group for the 256.Em _dhcpcd 257pseudo-user used by the 258.Xr dhcpcd 8 259DHCP Client Daemon. 260.It Em _rtadvd 261Primary group for the 262.Em _rtadvd 263pseudo-user used by the 264.Xr rtadvd 8 265IPv6 network router advertisement daemon. 266.It Em guest 267Guest users, in contrast to staff or regular users. 268Not used by 269.Nx ; 270available for the administrator's interpretation. 271.It Em _unbound 272Primary group for the 273.Em _unbound 274pseudo-user used by the 275.Xr unbound 8 276recursive DNS resolver. 277.It Em _nsd 278Primary group for the 279.Em _nsd 280pseudo-user used by the 281.Xr nsd 8 282authoritative DNS nameserver. 283.It Em nvmm 284Users authorized to use the 285.Xr nvmm 4 286.Nx 287Virtual Machine Monitor. 288.It Em nobody 289Primary group for the traditional 290.Em nobody 291pseudo-user. 292Modern practice is to assign to each different daemon its own separate 293pseudo-user account and group so that if one daemon is compromised it 294does not compromise all the other daemons. 295.It Em utmp 296Group of 297.Xr utmp 5 298login records. 299.\" Why? 300.It Em authpf 301Used by the set-group-id 302.Pq Xr setuid 7 303program 304.Xr authpf 8 305to configure authenticated gateways. 306.\" Does it actually use the sgid bit? It's also suid root... 307.It Em users 308Regular users, in contrast to staff or guest users. 309.Pp 310Default primary group for new users, as set in the default 311.Xr usermgmt.conf 5 312file. 313Some administrators may instead prefer to assign to each user a unique 314group with the same name as the user by passing the 315.So 316.Fl g Cm "=uid" 317.Sc 318option to 319.Xr useradd 8 . 320.It Em dialer 321Users authorized to make outgoing modem calls. 322Unused in modern 323.Nx . 324.It Em nogroup 325Pseudo-group. 326.\" For...? 327.El 328.\""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""" 329.Sh SEE ALSO 330.Xr users 7 331