Why the need to reboot upon group membership change

Question

Why does one need to reboot Linux system for group membership changes to take effect? I mean, why is not logging out and in again sufficient. The user session manager would reread the group file and that is it. What is the problem with this approach?

Answer 1

If you look at a process tree, you'll probably see that a large chunk of your (graphical) session is started indirectly, as child processes under systemd --user which acts as the session manager, and importantly, which is not part of your logon session as such – the entire manager is launched indirectly as a system service when you log in, then stopped when you log out.

More importantly, though:

• There's only one instance of this manager per UID, shared across all of your sessions, so it's not enough to log out from the graphical session if you still have any other (console, ssh) sessions present; it's only stopped when the user has no more sessions at all.

• In recent versions there is a deliberate delay before the manager is stopped after all sessions are gone. You might need to wait a minute before logging in again.

• The same manager is often used to run actual user-level services, so it may even be configured to start on boot and never exit. If you've done loginctl enable-linger in the past (check /var/lib/systemd/linger to see if you've done so), then the manager will stick around even after logout – until manually stopped with systemctl --user exit or until you reboot.

(Note that the component typically called "session manager" is not what reads your group memberships. That's done by the process that starts the session manager – e.g. by GDM for graphical logins.)

Answer 2

The short answer is that you don't need to reboot to update group membership, but any processes started by that account prior to the membership change will need to be restarted.

This will include any currently open login sessions, as well as (depending on your configuration) your graphical desktop service.