NAME
groups – standard group names
DESCRIPTION
A standard FreeBSD installation has the following user group names:
- wheel
-
Users authorized to elevate themselves to the super-user privileges of the root user, meaning uid 0. Normally the wheel group has gid 0.
Users who are not in the group wheel are never allowed by su(1) to gain root privileges.
- kmem
-
Used by the set-group-id programs (like ktrdump(8)) that need to access kernel memory (/dev/mem and /dev/kmem are in the group kmem). See mem(4).
- sys
-
Historic group. Unused in modern FreeBSD.
- tty
-
Used by the set-group-id programs wall(1) and write(1) to allow users to send messages to another tty even if they don't own it (static tty device nodes /dev/pts/* are all in the group tty). See tty(4).
- operator
-
Users authorized to take backups of disk devices and shut down the machine.
The disk device nodes (such as /dev/ada0) are in the group operator and group-readable so users in the group can read from disk devices, for example with dump(8). The tape device nodes (such as /dev/sa0) are in the group operator and are both group-readable and group-writable so users in the group can write to tape devices.
The shutdown(8) program is executable only by root and members of the operator group.
-
Used by mail agents (like dma(8)).
By default, root mail (/var/mail/root) is in the mail group.
- bin
-
Historic group. Unused in modern FreeBSD.
- news
-
Historic group. Unused in modern FreeBSD.
- man
-
Historic group; used to be used for managing manual pages (see man(1)).
- games
-
Used by various set-group-id games to maintain high-scores files and other common files in /var/games. The members of this group are also allowed to access /dev/input/event* device nodes (see hgame(4)). See also intro(6).
- ftp
-
Used to be used by sysinstall(8) (which is now replaced with bsdinstall(8)) for setting up anonymous FTP. Unused in modern FreeBSD.
- staff
-
Staff users, in contrast to guest users (see guest group). Not used by FreeBSD; available for the administrator's interpretation. See security(7) for some recommendations on managing accounts in staff group.
- sshd
-
Primary group for the sshd pseudo-user used by the sshd(8) secure shell daemon.
- smmsp
-
Primary group for user smmsp, which is used by sendmail(8) if no non-root users were configured for running it.
The name of the group means "SendMail Message Submission Program".
- mailnull
-
Used by electronic mail transport agent sendmail(8) as group for its default user mailnull.
- guest
-
Guest users, in contrast to staff users (see staff group). Not used by FreeBSD; available for the administrator's interpretation.
- audio
-
Used to access any device node created by sound(4), device drivers, and virtual_oss(8).
- video
-
Used for access to /dev/drm/* devices, which are used for GPU hardware acceleration. See drm(7).
- realtime
-
Used by mac_priority(4) to allow members of this group to run threads and processes with realtime scheduling priority. See also rtprio(1).
- idletime
-
Used by mac_priority(4) to allow members of this group to run processes with idle scheduling priority. See also idprio(1).
- bind
-
Used to be used as primary group for the bind pseudo-user used by named(8) Internet domain name server, which has been removed from the base system in FreeBSD 10.0.
- unbound
-
Primary group for the unbound pseudo-user used by the local-unbound(8) recursive DNS resolver.
- proxy
-
Primary group for the proxy pseudo-user used by the ftp-proxy(8) proxy daemon with packet filters such as pf(4).
- authpf
-
Used by the set-group-id program authpf(8) to configure authenticated gateways.
- _pflogd
-
Primary group for the _pflogd pseudo-user used by the pflogd(8) log daemon with the pf(4) packet filter.
- _dhcp
-
Primary group for the _dhcp pseudo-user used by the dhclient(8) DHCP Client.
- dialer
-
Users authorized to make outgoing modem calls (see cu(1) and /dev/cuauN devices).
- network
-
Historic group. Unused in modern FreeBSD.
- audit
-
Primary group for the auditdistd pseudo-user used by auditd(8) and auditdistd(8) audit daemons.
- www
-
Historic group for accessing World Wide Web. Unused in modern FreeBSD.
- u2f
-
Used for users who need to access /dev/u2f/* devices (see u2f(4)).
- ntpd
-
Primary group for the ntpd pseudo-user used by the ntpd(8) network time protocol daemon.
- _ypldap
-
Primary group for the _ypldap pseudo-user used by ypldap(8) daemon.
- hast
-
Primary group for the hast pseudo-user used by Highly Available Storage daemon hastd(8).
- tests
-
Primary group for the tests pseudo-user used by automatic tests that request to run unprivileged. See tests(7).
- nogroup
-
Pseudo-group (fake group). It differs from group nobody in way that nogroup doesn't have a dedicated user for it. For instance, this group is used for users tty and kmem.
- nobody
-
Primary group for the traditional nobody pseudo-user. Modern practice is to assign to each different daemon its own separate pseudo-user account and group so that if one daemon is compromised it does not compromise all the other daemons.
See also group nogroup.
FILES
- /etc/group
-
Main group permissions file.
- /usr/src/etc/group
-
Group permissions file for the base system.
- /usr/ports/GIDs
-
A list of GIDs (group IDs) reserved for ports (see ports(7)).
See group(5) for the format of abovementioned files.
SEE ALSO
HISTORY
The groups manual page appeared in NetBSD 10.0 and FreeBSD 15.1.