Chapter 9. The Operating System

63

Some user ids (UIDs) and group ids (GIDs) are reserved globally for use by certain packages.

Because some packages need to include files which are owned by these users or groups, or

need the ids compiled into binaries, these ids must be used on any Debian system only for the

purpose for which they are allocated. This is a serious restriction, and we should avoid getting

in the way of local administration policies. In particular, many sites allocate users and/or local

system groups starting at 100.

Apart from this we should have dynamically allocated ids, which should by default be ar 

ranged in some sensible order, but the behavior should be configurable.

Packages other than

base passwd

must not modify

/etc/passwd

,

/etc/shadow

,

/etc

/group

or

/etc/gshadow

.

9.2.2 UID and GID classes

The UID and GID numbers are divided into classes as follows:

0 99: Globally allocated by the Debian project, the same on every Debian system. These ids

will appear in the

passwd

and

group

files of all Debian systems, new ids in this range

being added automatically as the

base passwd

package is updated.

Packages which need a single statically allocated uid or gid should use one of these; their

maintainers should ask the

base passwd

maintainer for ids.

100 999: Dynamically allocated system users and groups. Packages which need a user or

group, but can have this user or group allocated dynamically and differently on each

system, should use

adduser   system

to create the group and/or user.

adduser

will

check for the existence of the user or group, and if necessary choose an unused id based

on the ranges specified in

adduser.conf

.

1000 29999: Dynamically allocated user accounts. By default

adduser

will choose UIDs and

GIDs for user accounts in this range, though

adduser.conf

may be used to modify this

behavior.

30000 59999: Reserved.

60000 64999: Globally allocated by the Debian project, but only created on demand. The ids

are allocated centrally and statically, but the actual accounts are only created on users'

systems on demand.

These ids are for packages which are obscure or which require many statically allocated

ids. These packages should check for and create the accounts in

/etc/passwd

or

/etc

/group

(using

adduser

if it has this facility) if necessary. Packages which are likely to

require further allocations should have a  hole  left after them in the allocation, to give

them room to grow.

65000 65533: Reserved.

65534: User

nobody

. The corresponding gid refers to the group

nogroup

.