NAME

groups — standard group names

DESCRIPTION

A standard FreeBSD installation has the following user group names:

wheel

Users authorized to elevate themselves to the super-user privileges of the root user, meaning uid 0. Normally the wheel group has gid 0.

Users who are not in the group wheel are never allowed by su(1) to gain root privileges.

daemon

Used by the set-group-id programs lpr(1) and rwho(1).

kmem

Used by the set-group-id programs (like ktrdump(8)) that need to access kernel memory (/dev/mem and /dev/kmem are in the group kmem). See mem(4).

sys

Historic group. Unused in modern FreeBSD.

tty

Used by the set-group-id programs wall(1) and write(1) to allow users to send messages to another tty even if they don't own it (static tty device nodes /dev/pts/* are all in the group tty). See tty(4).

operator

Users authorized to take backups of disk devices and shut down the machine.

The disk device nodes (such as /dev/ada0) are in the group operator and group-readable so users in the group can read from disk devices, for example with dump(8). The tape device nodes (such as /dev/sa0) are in the group operator and are both group-readable and group-writable so users in the group can write to tape devices.

The shutdown(8) program is executable only by root and members of the operator group.

mail

Used by mail agents (like dma(8)).

By default, root mail (/var/mail/root) is in the mail group.

bin

Historic group. Unused in modern FreeBSD.

news

Historic group. Unused in modern FreeBSD.

man

Historic group; used to be used for managing manual pages (see man(1)).

games

Used by various set-group-id games to maintain high-scores files and other common files in /var/games. The members of this group are also allowed to access /dev/input/event* device nodes (see hgame(4)). See also intro(6).

ftp

Used to be used by sysinstall(8) (which is now replaced with bsdinstall(8)) for setting up anonymous FTP. Unused in modern FreeBSD.

staff

Staff users, in contrast to guest users (see guest group). Not used by FreeBSD; available for the administrator's interpretation. See security(7) for some recommendations on managing accounts in staff group.

sshd

Primary group for the sshd pseudo-user used by the sshd(8) secure shell daemon.

smmsp

Primary group for user smmsp, which is used by sendmail(8) if no non-root users were configured for running it.

The name of the group means "SendMail Message Submission Program".

mailnull

Used by electronic mail transport agent sendmail(8) as group for its default user mailnull.

guest

Guest users, in contrast to staff users (see staff group). Not used by FreeBSD; available for the administrator's interpretation.

video

Used for access to /dev/drm/* devices, which are used for GPU hardware acceleration. See drm(7).

realtime

Used by mac_priotiry(4) to allow members of this group to run threads and processes with realtime scheduling priority. See also rtprio(1).

idletime

Used by mac_priority(4) to allow members of this group to run processes with idle scheduling priority. See also idprio(1).

bind

Used to be used as primary group for the bind pseudo-user used by named(8) Internet domain name server, which has been removed from the base system in FreeBSD 10.0.

unbound

Primary group for the unbound pseudo-user used by the local-unbound(8) recursive DNS resolver.

proxy

Primary group for the proxy pseudo-user used by the ftp-proxy(8) proxy daemon with packet filters such as pf(4).

authpf

Used by the set-group-id program authpf(8) to configure authenticated gateways.

_pflogd

Primary group for the _pflogd pseudo-user used by the pflogd(8) log daemon with the pf(4) packet filter.

_dhcp

Primary group for the _dhcp pseudo-user used by the dhclient(8) DHCP Client.

dialer

Users authorized to make outgoing modem calls (see cu(1) and /dev/cuauN devices).

network

Historic group. Unused in modern FreeBSD.

audit

Primary group for the auditdistd pseudo-user used by auditd(8) and auditdistd(8) audit daemons.

www

Historic group for accessing World Wide Web. Unused in modern FreeBSD.

u2f

Used for users who need to access /dev/u2f/* devices (see u2f(4)).

ntpd

Primary group for the ntpd pseudo-user used by the ntpd(8) network time protocol daemon.

_ypldap

Primary group for the _ypldap pseudo-user used by ypldap(8) daemon.

hast

Primary group for the hast pseudo-user used by Highly Available Storage daemon hastd(8).

tests

Primary group for the tests pseudo-user used by automatic tests that request to run unprivileged. See tests(7).

nogroup

Pseudo-group (fake group). It differs from group nobody in way that nogroup doesn't have a dedicated user for it. For instance, this group is used for users tty and kmem.

nobody

Primary group for the traditional nobody pseudo-user. Modern practice is to assign to each different daemon its own separate pseudo-user account and group so that if one daemon is compromised it does not compromise all the other daemons.

See also group nogroup.

FILES

/etc/group

Main group permissions file.

/usr/src/etc/group

Group permissions file for the base system.

/usr/ports/GIDs

A list of GIDs (group IDs) reserved for ports (see ports(7)).

See group(5) for the format of abovementioned files.

SEE ALSO

chgrp(1), groups(1), id(1), newgrp(1), group(5), pw(8)

HISTORY

The groups manual page appeared in NetBSD 10.0 and FreeBSD 15.1.