= Access-control group
An <access-control group> collects security principals so that a permission can be assigned to the collection rather than copied separately for every member. A <file> might grant read access to a laboratory group while withholding write access. Changing membership then changes who obtains the group's applicable permissions.
In Unix-style systems, <operating-system process>[process] credentials include group identifiers, including supplementary groups, and <file> permission checks use the relevant identity information.<Credentials in the Linux man-pages project>[User and group identifiers]{ref} The membership considered for an already running <operating-system process>[process] need not change immediately when an account <database> is edited. Group names, account membership and the credentials used for a particular access check are therefore related but distinct pieces of <state>. Grouping users for permissions also does not imply that their <operating-system processes>[processes] are one scheduling job.
Back to article page
