Why don't supplemental groups take effect without a reboot?

Discussions in English on using Fedora
#1

I’m seeing an odd problem on Fedora 32. I issue the command

sudo usermod -G groupname -a username

for my own username. The command runs. I check the /etc/group file and I am still listed as a member of all the groups I used to be a member of plus the new group.

I then log out of the graphical desktop and log back in (specifically so I can get my new group membership). Upon opening a terminal shell and issuing the ‘groups’ command, I only see the old list of groups for my account. No matter how many times I do this, I won’t be a member of the newly added group. If I reboot the system, and log in afterwards, only then will I be a member of the new group.

So why isn’t a group membership change taking effect just upon logging in again?

Uname info:
5.9.15-100.fc32.x86_64 #1 SMP Wed Dec 16 16:49:20 UTC 2020 x86_64 x86_64 x86_64 GNU/Linux

Note that this has been happening since at least kernel 5.8. Not sure how far back it has been happening, since my group membership doesn’t change that often.

1 Like
#2

A quick workaround:

sudo pkill -SIGKILL -u ${USER}

A more reliable solution:

sudo mkdir -p /etc/systemd/logind.conf.d
sudo tee /etc/systemd/logind.conf.d/00-custom.conf << EOF
[Login]
KillUserProcesses=yes
EOF
sudo systemctl restart systemd-logind.service

See also: logind.conf

#3

For an already logged in user to get the new group, you should use newgrp:

$ newgrp groupname

If you are logged in a graphical interface, the login happens at the beginning when you enter the password in GDM, and as all the shells you open are children of the same session, they inherit the same groups from the initial login.

#4

I think you missed the point. I explicitly logged out and logged back in to GDM. “Why didn’t the group membership change take effect after logging out and in again?” is the point.

#5

This happens when your previous session scope becomes abandoned, e.g. due to some user processes not responding to SIGTERM, so you need to send SIGKILL.