Usefulness of adding users to groups

dolby · 2012-09-22 13:41:39

Is adding users to groups any useful if you are using desktop environments, especiallly KDE and GNOME?

brebs · 2012-09-22 14:06:46

$ groups
lp cdrom audio video games wheel usb plugdev users vboxusers

(Different distro, but useful perspective).

So yeah, it's useful, otherwise I couldn't run 3D ("video" group), games ("games" group, although IIRC Arch doesn't bother with this), or even play audio.

As to why these groups exist, which is probably your second question - it's the whole "layers of security" thing.

dolby · 2012-09-22 14:28:17

$groups
dolby

Different distro but useful perspective
I can play audio, games and i have 3d.

Isnt polkit used in Arch?

Fine read http://lwn.net/Articles/258592/

brebs · 2012-09-22 14:41:01

polkit has gone crazy with its new reliance on Javascript. Not KISS, and not wanted.

Which reminds me, I should probably look again at removing PAM.

65kid · 2012-09-22 15:08:39

If you are using ConsoleKit or systemd-logind you don't need to be in any of those audio/video etc. groups, polkit will take care of it. I personally only use "sudo" and "adm" (to use journalctl).

and while I don't agree with the whole "consolekit and/or polkit are bloat", I do agree that the decision to use JavaScript to write rules is ridiculous. but that's kind of off-topic...

dolby · 2012-09-22 15:26:24

Thats what i thought. My interest for bringing this up is that the Arch Wiki has the stuff about groups carved all over the place when in many of those situations its not needed. For example the beginners guide:
https://wiki.archlinux.org/index.php/Be … stallation
but my intent was for this discussion to reach a wider audience, otherwise i would have edited the wiki.

edit: Yes i know that not all people are using polkit and the like.

Last edited by dolby (2012-09-22 15:42:17)

WonderWoofy · 2012-09-22 15:33:12

I have always used groups, and never even thought about the fact that polkit would take care of these things. I guess there are a few that I really do need to be in, like kvm (kernel virtual machines), tty (so that I can use directfb driven stuff without root), cdemu (its just a neat program), and sys (so that I can fix my printers w/o root).

But I guess the typical optical, video, audio, etc are not longer needed w/ polkit? Sounds neat to me!

65kid · 2012-09-22 15:54:31

WonderWoofy wrote:

I have always used groups, and never even thought about the fact that polkit would take care of these things. I guess there are a few that I really do need to be in, like kvm (kernel virtual machines), tty (so that I can use directfb driven stuff without root), cdemu (its just a neat program), and sys (so that I can fix my printers w/o root).
But I guess the typical optical, video, audio, etc are not longer needed w/ polkit? Sounds neat to me!

actually kvm works fine here without the group too.

falconindy · 2012-09-22 16:35:57

65kid wrote:

WonderWoofy wrote:
I have always used groups, and never even thought about the fact that polkit would take care of these things. I guess there are a few that I really do need to be in, like kvm (kernel virtual machines), tty (so that I can use directfb driven stuff without root), cdemu (its just a neat program), and sys (so that I can fix my printers w/o root).
But I guess the typical optical, video, audio, etc are not longer needed w/ polkit? Sounds neat to me!
actually kvm works fine here without the group too.

That's courtesy of udev and ACLs -- nothing to do with polkit.

$ getfacl /dev/kvm 
getfacl: Removing leading '/' from absolute path names
# file: dev/kvm
# owner: root
# group: kvm
user::rw-
user:noclaf:rw-
group::rw-
mask::rw-
other::---

65kid · 2012-09-22 16:47:47

falconindy wrote:

65kid wrote:
WonderWoofy wrote:
I have always used groups, and never even thought about the fact that polkit would take care of these things. I guess there are a few that I really do need to be in, like kvm (kernel virtual machines), tty (so that I can use directfb driven stuff without root), cdemu (its just a neat program), and sys (so that I can fix my printers w/o root).
But I guess the typical optical, video, audio, etc are not longer needed w/ polkit? Sounds neat to me!
actually kvm works fine here without the group too.
That's courtesy of udev and ACLs -- nothing to do with polkit.
$ getfacl /dev/kvm 
getfacl: Removing leading '/' from absolute path names
# file: dev/kvm
# owner: root
# group: kvm
user::rw-
user:noclaf:rw-
group::rw-
mask::rw-
other::---

Ah, interesting. so udev/ACL takes care of device node permissions and polkit is only for actions like "mount external disk" and "set up the network" (NetworkManager)?
So what is responsible for actually setting the ACLs when I log in? ConsoleKit/logind? PAM?

falconindy · 2012-09-22 17:05:55

It's a two part process:

1) udev rules tag devices with "uaccess" and "seat". These are devices which are possible candidates for unprivileged access.
2) On new session creation, logind or consolekit (udev-acl) applies ACLs based on authentication of the session (at_console rules, etc).

65kid · 2012-09-22 17:13:27

falconindy wrote:

It's a two part process:
1) udev rules tag devices with "uaccess" and "seat". These are devices which are possible candidates for unprivileged access.
2) On new session creation, logind or consolekit (udev-acl) applies ACLs based on authentication of the session (at_console rules, etc).

you never stop learning, thanks for the explanation.

WonderWoofy · 2012-09-22 20:33:05

65kid wrote:

falconindy wrote:
It's a two part process:
1) udev rules tag devices with "uaccess" and "seat". These are devices which are possible candidates for unprivileged access.
2) On new session creation, logind or consolekit (udev-acl) applies ACLs based on authentication of the session (at_console rules, etc).
you never stop learning, thanks for the explanation.

Yeah, I did not expect to get such amazing info from this thread

cfr · 2012-09-22 22:24:31

Does the application of ACLs by logind/consolekit apply to file systems where they are not specified, as with regular permissions? That is, aren't specific ACLs set for directories and files in the same way that permissions are i.e. they are part of the files' attributes?

[I'm not expressing this question very well.]

bwat47 · 2012-09-22 22:50:26

brebs wrote:

$ groups
lp cdrom audio video games wheel usb plugdev users vboxusers
(Different distro, but useful perspective).
So yeah, it's useful, otherwise I couldn't run 3D ("video" group), games ("games" group, although IIRC Arch doesn't bother with this), or even play audio.
As to why these groups exist, which is probably your second question - it's the whole "layers of security" thing.

You don't even need the audio group if you run pulseaudio

WonderWoofy · 2012-09-23 00:21:57

bwat47 wrote:

You don't even need the audio group if you run pulseaudio

I think this thread actually indicates you don't need the audio group (or a few others) if you run consolekit/polkit.

dolby · 2012-09-23 00:22:47

So now that systemd is becoming the default (replacing consolekit) are there any groups that are actually needed?

HerbertJones · 2012-10-04 08:54:51

Yes. You need "games" to run Dwarf Fortress.

Last edited by HerbertJones (2012-10-04 08:55:36)

Arch Linux

#1 2012-09-22 13:41:39

Usefulness of adding users to groups

#2 2012-09-22 14:06:46

Re: Usefulness of adding users to groups

#3 2012-09-22 14:28:17

Re: Usefulness of adding users to groups

#4 2012-09-22 14:41:01

Re: Usefulness of adding users to groups

#5 2012-09-22 15:08:39

Re: Usefulness of adding users to groups

#6 2012-09-22 15:26:24

Re: Usefulness of adding users to groups

#7 2012-09-22 15:33:12

Re: Usefulness of adding users to groups

#8 2012-09-22 15:54:31

Re: Usefulness of adding users to groups

#9 2012-09-22 16:35:57

Re: Usefulness of adding users to groups

#10 2012-09-22 16:47:47

Re: Usefulness of adding users to groups

#11 2012-09-22 17:05:55

Re: Usefulness of adding users to groups

#12 2012-09-22 17:13:27

Re: Usefulness of adding users to groups

#13 2012-09-22 20:33:05

Re: Usefulness of adding users to groups

#14 2012-09-22 22:24:31

Re: Usefulness of adding users to groups

#15 2012-09-22 22:50:26

Re: Usefulness of adding users to groups

#16 2012-09-23 00:21:57

Re: Usefulness of adding users to groups

#17 2012-09-23 00:22:47

Re: Usefulness of adding users to groups

#18 2012-10-04 08:54:51

Re: Usefulness of adding users to groups

Board footer