How do I add a user to a group in Linux without removing existing groups?

To add a user to a group without losing their current group memberships, always use the append flag with usermod. Run sudo usermod -aG groupname username. Leaving out the letter a overwrites all existing secondary groups and can lock users out of administrative access.

What is the difference between primary and secondary groups in Linux?

Every Linux user has one primary group and zero or more secondary groups. The primary group is stamped automatically onto any new file or folder you create. Secondary groups are additional teams you belong to, which help you share access to resources without changing file ownership defaults.

Why don't my new group permissions work immediately after adding a user?

Group memberships are evaluated and cached when a user logs in. If you add someone to a new group while their session is active, their current shell does not inherit the update. They must log out and back in, or run newgrp groupname to refresh permissions in the current terminal.

What does chmod 755 mean in Linux file permissions?

The octal permission 755 gives the file owner full read, write, and execute permissions. The group and other users receive read and execute permissions, but cannot modify the file. This is the standard setting for executable scripts and application binaries you want others to run safely.

How do I check which groups a user belongs to?

You can inspect group memberships using several commands. Run groups username to see a quick list of group names, or run id username to view numeric UIDs, GIDs, and all associated groups. For a deeper study of system administration fundamentals, explore our comprehensive Linux training.

Why are root user permissions special on Linux systems?

The root user has a user ID of zero, which triggers a hardcoded rule in the Linux kernel to bypass standard file permission checks. Root is not restricted by standard read, write, or execute bitmasks, making it essential to operate under unprivileged service users in production environments.

DevOps

Linux Groups and File Permission: Complete Admin Guide

Master Linux groups and File Permission with this practical guide covering user creation, group memberships, sudo privileges, and file permissions.

Gs Dwivedi

September 11, 2026 · 14 min read · Updated Oct 12, 2026

Linux Groups and File Permission: Complete Admin Guide

You stare at the terminal at 2:00 AM because an automated deployment pipeline crashed with a permission denied error. A junior engineer added a CI runner to the deployment team without the append flag, stripping sudo access and locking the app out of its log directory. Understanding linux groups and file permissions stops these production outages before they break your release cadence.

Bash

passwd                      # change my own
sudo passwd ravi           # change hers
sudo passwd -l ravi        # lock
sudo passwd -u ravi        # unlock
sudo passwd -S ravi       # status: P = usable, L = locked, NP = none
sudo passwd -e ravi       # force a change at next login

Deleting a user

Bash

sudo userdel ravi         # remove the account, keep his home folder
sudo userdel -r ravi       # remove the account AND delete his home folder

Switching identity

Bash

sudo apt update             # do ONE thing as root
sudo -u ravi whoami        # do one thing as ravi
sudo -i                     # become root fully
su - ravi                  # become ravi fully
sudo -l                     # what am I allowed to run with sudo?

Giving someone admin rights

Creating and Managing Groups

Why groups exist

Bash

sudo usermod -aG sudo priya       # Ubuntu / Debian
sudo usermod -aG wheel priya      # Fedora / RHEL

Without groups, giving five people access to a folder means five separate grants. Add a sixth person and you do it again. Remove someone and you have to remember every folder they touched. With a group, you grant access to the group once. Membership becomes the only thing you manage.

Create a group

Bash

sudo groupadd devs

# If you need a specific number (useful when matching another machine):
sudo groupadd -g 2000 devs

That's it. Check it worked:

Bash

getent group devs

Add people to it

Bash

sudo usermod -aG devs priya
sudo usermod -aG devs ravi

Key note

The -a is not optional. It means append. Without it, usermod -G devs priya replaces all her groups with just devs — silently removing her from sudo, docker, and everything else. This is the single most common way people lock themselves out of their own machine.

Verify

Bash


groups priya            # which groups is she in
getent group devs       # who is in this group
id priya                # everything at once

The thing that confuses everyone

After adding someone to a group, they must log out and log back in. Group membership is stamped onto a login session when it starts. Changing the file doesn't reach into a session that's already running. Their badge was reprinted, but they're still carrying the old one. To test it without logging out:

Bash


newgrp devs         # starts a sub-shell with the new group active
#Type exit to leave that sub-shell.

Primary vs secondary groups

Every user has one primary group and any number of secondary groups. The primary group is the one stamped on every file they create. That's the only practical difference, but it matters a lot in Part 3.

Bash

sudo usermod -g devs priya      # -g (lowercase) changes the PRIMARY group
sudo usermod -aG devs priya     # -aG (capital) adds a SECONDARY group

Key note

Lowercase -g replaces. Capital -aG adds. Different letters, completely different behaviour.

Remove and delete

Bash

sudo gpasswd -d priya devs      # remove one person from the group
sudo groupdel devs              # delete the group entirely

Changing File Permissions (chmod)

First, read what's there

Bash

ls -l notes.txt

The nine letters after the first character are three sets of three:

Bash

 rw-    r--    r--
owner  group  everyone

Key note

r = read w = write/edit x = run. - (dash) = means not allowed.

The numbers

Key note

read = 4 write = 2 run = 1

Change it — by number

Bash

chmod 644 notes.txt      # owner edits, everyone reads
chmod 600 secrets.txt    # only owner, nobody else at all
chmod 755 script.sh      # owner does all, others read and run
chmod 750 script.sh      # owner does all, group reads and runs, others nothing
chmod 660 shared.txt     # owner and group edit, others nothing

Change it — by letter

bash

chmod +x script.sh          # make it runnable
chmod u+x script.sh         # only the owner can run it
chmod g+w report.txt        # let the group edit
chmod o-r private.txt       # stop everyone else from reading
chmod g=r,o= data.txt       # group reads exactly; others nothing

linux groups and file permissionlinux users and groupschmod commandchown commandusermod append flaglinux administration

Linux Groups and File Permission: Complete Admin Guide

Deleting a user

Switching identity

Giving someone admin rights

Creating and Managing Groups

Why groups exist

Create a group

That's it. Check it worked:

Add people to it

Verify

The thing that confuses everyone

Primary vs secondary groups

Remove and delete

Changing File Permissions (chmod)

First, read what's there

The nine letters after the first character are three sets of three:

The numbers

Change it — by number

Change it — by letter

Frequently asked questions