Arch Linux

jefdaj

Member

Registered: 2012-12-05

Posts: 25

[solved] Which users and groups are safe to remove?

First of all, sorry if this is in the wrong place. It's kind of security related, but also a pretty general question.

I've used linux for a while, and there have always been mysterious permissions errors. So I decided to demystify them by setting up everything right. I'm starting by removing unneeded users and groups.

Problem is, how can I tell which are safe to remove and which will cause weird problems later? For example, the audio group shouldn't be needed according to the Users and Groups page. Here are the relevant entries as far as I know:

# /etc/group
audio:x:92:jefdaj

# /etc/passwd
nothing contains 'audio' or '92'

# /etc/shadow
nothing contains 'audio' or '92'

Removing jefdaj from the list in /etc/group is fine, but actually removing the group with groupdel prevents QuodLibet from playing music. Can a group be in use even though it has no users? Is there any way to check other than deleting each group and waiting a while to see if anything breaks?

Also, semi-related: what does "!" mean in /etc/shadow entries?

Last edited by jefdaj (2013-04-05 21:40:12)

opt1mus

Member

From: UK

Registered: 2011-12-31

Posts: 212

Website

Re: [solved] Which users and groups are safe to remove?

[...] what does "!" mean in /etc/shadow entries?

The ! is within the password field of that particular group, and means no password. This I understand is now an x
'group' manpage

Brief mention of the password field in another forum thread

Last edited by opt1mus (2013-03-30 19:28:39)

WonderWoofy

Member

From: Los Gatos, CA

Registered: 2012-05-19

Posts: 8,414

Re: [solved] Which users and groups are safe to remove?

The reason you should not have your user in various groups is because logind handles this in conjunction with udev.  If you check out /usr/lib/udev/rules.d/70-uccess.rules you can see exactly what things udev is applying the "uaccess" tag to.  Figure out what those things apply to in terms of groups and remove your user from those.

For example , my user is in the following groups:

% groups
wheel users vboxusers systemd-journal 

jefdaj

Member

Registered: 2012-12-05

Posts: 25

Re: [solved] Which users and groups are safe to remove?

OK, so I have these groups:
sys lp video optical storage scanner power magick users

The scanner group is probably covered by this right?
# SCSI and USB scanners
ENV{libsane_matched}=="yes", TAG+="uaccess"

And lp?
# HPLIP devices (necessary for ink level check and HP tool maintenance)
ENV{ID_HPLIP}=="1", TAG+="uaccess"

Actually I think I added most of them while installing Arch, and they're probably not necessary anymore. Looks like there are entries related to storage and video too at least.

Just to make sure I'm undertanding, I can remove myself from a lot of these groups, but I should leave the groups themselves so things can be added to them dynamically?

I notice you have wheel too... what does that do? From what I can tell it's a legacy thing related to sudo, and is now going to be used by systemd? Should I also have systemd-journal?

WonderWoofy

Member

From: Los Gatos, CA

Registered: 2012-05-19

Posts: 8,414

Re: [solved] Which users and groups are safe to remove?

Well it would seem that if you removed the groups themselves, it would break the uaccess functionality, wouldn't it? 

Issue a "journalctl" on the command line and see what it tells you.  I have it because it is convenient, but it is not necessary.

jefdaj

Member

Registered: 2012-12-05

Posts: 25

Re: [solved] Which users and groups are safe to remove?

Cool, I wasn't sure if the udev rules use the groups or replace them. I removed myself from most of those groups, and now everything's working well.
Thanks!

P.S. journalctl does seem really convenient! I think I'll run it as a regular user though, because that way I can diagnose persmissions issues by looking at the difference between normal and sudo output.

WonderWoofy

Member

From: Los Gatos, CA

Registered: 2012-05-19

Posts: 8,414

Re: [solved] Which users and groups are safe to remove?

Fantastico! Please mark your thread as solved by editing the first post and prepending it to the title (preferably in square brackets, line this --> [solved] )