Root ownership

[Dorothy Lim_1]

I am puzzled by the ownership of root.

I have some files previously created via root & the ownership is root:root.

Recently, files created has the ownership of root:sys.

Nobody in the shop claims to have change anything.

Can someone shed some lights ?

Thks

[Cheryl Griffin_1]

The group is determined by the GID (group ID). This means that the file will
have the user or daemon's when the file is created.

Root belongs to many groups. To view which groups, on your system login as
root and execute the command 'id'.

It will display something like the following:
# id
uid=0(root) gid=3(sys)
groups=0(root),1(other),2(bin),4(adm),5(daemon),6(mail),7(lp),20(users)

Here is an brief explanation of each of these groups:
root
User 0, the superuser.

daemon
Used to execute system server processes. This user only exists to own these
processes (and associated files) and to guarantee that they executre with
appropriate file access permissions.

bin
Typically owns the executable files for most user commands.

sys
Owns system files.

adm
Owns accounting files.

cron, mail, news, usenet, lp, daemon, uucp, auth, audit
Pseudo-users which own files and processes needed by the corresponding
subsystems.

user, users, other, staff
Group for users and other non-system related functions.

For more information on groups, see the man pages for group(4), id(1),
passwd(4).

[Paul Hite_2]

Well, which group the files created is controlled by the 4th field of root's
entry in /etc/passwd. You currently have a 3 and you are saying that you used
to have a 0.

Maybe you were using another vendor's syetem? It's 0:3 on all our HP-UX boxes,
which causes root:sys on files. Getting root:root on an HP really would imply a
change, but root:sys sounds pretty standard.

There is one exception to all of this. If a directory has root as its group
and the sguid bit in the directory's inode is set, the group of files created
in that directory will set to root. Could you have been creating files in such
a directory? This is another possible explanation.