How to add a user to a group without logout/login - Bash script

Question

I searched and could not find this answer anywhere else. Apologies if it's a bit of a noob question for someone not that experienced at scripting.

I'm trying to create a bash script to setup a server with all software needed for an application. In short, when installing docker I need to add the current user to the docker group 'usermod -aG docker ', and from there, pull some containers.

The problem I have is that because I've added the user to a group, they need to be logged out and back in again before they have any permission to do anything later in the script. This of course breaks the script and ends the shell session. Is there a way to log out and back in again within the same script, or do things need to get a little more complicated?

Appreciate anyone's help on this. Hope it's a simple answer for someone.

Answer 1

Use the newgrp command to login to a new group.

The way newgrp works is that it changes the group identification of its caller, analogously to login. The same person remains logged in, and the current directory is unchanged, but calculations of access permissions to files are performed with respect to the new group ID.

So for your case, you’ll use:

# usermod -aG docker user
# newgrp docker

Check your new primary group, it should be docker:

$ id -g
989

Confirm from /etc/group

$ cat /etc/group | grep `id -g`
docker:x:989:jmutai

This should do the trick.

Answer 2

use this command:

exec su -l $USER

or:

exec sudo su -l $USER

Answer 3

I worked around this issue by setting the setgid flag on the docker binary:

sudo chgrp docker $(which docker)
sudo chmod g+s $(which docker)

The first line changes the group of the docker binary to the docker group. The second line enables the setgid flag, which means when you run this binary your group changes the file's group, which we just set to docker.

This is a security issue because it makes it so that effectively everyone is in the docker group, but I did this inside of a container where the only user is the one that I want to add to the docker group anyway. So this solution is only good for specific cases, but in those cases it seems to work well.

Answer 4

As far as I know - NO. To avoid this problem, I personally use ansible (ansible uses SSH). I break connection after adding user to group, reconnect, and continue script.

Answer 5

The user needs to be login again and then only the member added to the new group will have permissions to access the files/folders or run any command. The link https://unix.stackexchange.com/questions/6387/i-added-a-user-to-a-group-but-group-permissions-on-files-still-have-no-effect/11573#11573 gives a detailed explanation why this needs to be done.

You need to use any of the way to login again and then only you can proceed with your script.

In case you need to use only a single user, then you can use the below command to login again:

su -l USERNAME

This will ask password here. For that you can use pam authentication module to use the above command without password. You need to add the below line after pam_rootok.so in the file /etc/pam.d/su

auth       [success=ignore default=1] pam_succeed_if.so user = USERNAME
auth       sufficient   pam_succeed_if.so use_uid user = USERNAME

I believe this can be done via your current script only and there won't be any need to break the script.

(NOTE: Please replace the USERNAME in the above commands with your actual username)

Answer 6

newgrp <GroupName> << END
my_command
END

see my answer here: https://superuser.com/questions/272061/reload-a-linux-users-group-assignments-without-logging-out#

Answer 7

At 2023-08-12, the highest-voted answer to this question proposes using newgrp docker. newgrp docker will set that user's primary group to the group specified (you can verify this by running groups and seeing that docker is the first value returned).

But the question is looking for an alternative to logging out and logging back in again. Logging out and logging back in again will not modify the primary group of that user - it will have the effect of updating the list of secondary groups to include the previously added group. (Again, you can verify this by running groups and seeing that docker is again in the list of groups returned, but it is not the first value). Hence running newgrp will not have the same effect as logging out and logging back in again. Running newgrp and logging out and logging back in again will result in 2 different group membership lists.

If you want to update that user's list of secondary groups to include the previously added group (i.e. if you want a command that has the same effect as logging out and logging back in again) try: exec sg docker newgrp

HTH.

(For a bonus point, also note that (unlike su) exec sg docker newgrp works without requiring a password.)

Answer 8

You can't upgrade groups for the current script. You have to log in again.

However, that does not mean you have to log out first.

You can use any command like sudo, sg or su that technically creates a new session:

usermod -aG docker "$USER"  # Add to group
sg "$(id -gn)" -c "groups"  # Create new session and show groups including that one