2

It seems somewhat similar to the question here but I think what I'm asking is a little different.

I've got a CentOS 5.x box running with mysql on it. The root linux user can edit/modify files in /var/lib/mysql/ sub-directories but most (if not all) of these directories have file system ownerships of mysql:mysql.

When I run groups root I see: 

[root@foo ~]# groups root
root : root bin daemon sys adm disk wheel

I get that root is a privileged account and can/will have access to everything but why don't I see mysql in the list of groups it belongs to?

Rui F Ribeiro
  • 56,709
  • 26
  • 150
  • 232
Mike B
  • 8,900

2 Answers2

1

Actually as root is privileged, it does not need to be in any group – it just ignores the file ownership. Think of it in therms of the administrator account in windows.

jmk
  • 137
  • OK, that makes sense. If that's the case though, why are there ANY groups listed in the output of groups root? – Mike B Mar 17 '14 at 20:07
  • actually I don't know of a real reason – but with the newgrp command you can reset your GID to any of your secondary ones. If this is needed during startup or for some dæmons to work correctly, I can't say for sure – jmk Mar 17 '14 at 20:28
1

The definition of the root user dictates that it has control over all files on the disk, irregardless of the user's & groups that own said files & directories.

Many Unixes, such as Solaris, used to have a limitation where users could not be in more than 15 groups. NIS another technology for sharing user/group/automounting information also had this limitation.

So typically you would not see the root user in these groups. For one it wasn't possible to do so (given this limit), and also it was not needed for the root user to access files/directories with other ownership anyway. Additionally it's often considered bad design to have all your services/daemons running as root, instead they would each be governed by their own dedicated users & groups.

So the simple answer to your question is root doesn't need to be in those groups because it can do anything it wants to the files/directories on a system, it's the master owner and has complete dictatorship over the files that are local to the system.

So then why is root in any groups?

This is more of a historical practice where you used to see root in several key groups. This is being phased out, to my knowledge, and most of the newer systems that I've supported no longer have this, since it's completely unnecessary now.

Fedora 19

$ groups root
root : root

CentOS 6

$ groups root
root : root bin daemon sys adm disk wheel

NOTE: The primary purpose you'll often times see root in other groups is to allow root to create files within these groups directly, without having to do a chgrp or chown after creating files in directories that are grouped to one of these groups afterwards. When root needs to assume one of the other groups it can run a simple newgrp <group> to switch if needed, or respect a directory that already has the SGID bit on a directory.

References

Community
  • 1
slm
  • 369,824