Change Your Shell's Group Safely with newgrp

newgrp swaps your shell's primary group on the spot, and because it only lasts for that one shell, it is one of the safest ways to test group access. You will finish with a shell running under the group you chose, plus a quick way to prove which group it actually picked up. This is a session-level change: it does not edit your account, group membership or any file ownership.

Allow about ten minutes. You need a local account and a group that already exists. The examples use the newgrp shipped with the Ubuntu login package, version 1:4.13+dfsg1-4ubuntu3.2, based on shadow-utils 4.13. You do not need sudo for the normal examples.

1. Check the Installed Command

Confirm the binary and package before you trust any option detail below. These are read-only checks:

$ command -v newgrp
/usr/bin/newgrp
$ dpkg-query -W -f='${Package} ${Version}\n' login
login 1:4.13+dfsg1-4ubuntu3.2
$ newgrp --version
Usage: newgrp [-] [group]

The interface is deliberately small: an optional group name, or - to reinitialise the environment as though you had logged in again. This installed command's synopsis has no long options at all.

2. Choose an Existing Group

Start with your current primary group. It is the safest smoke test going, it asks for no new access and is unlikely to prompt for a group password:

$ id -gn
PRIMARY_GROUP
$ getent group PRIMARY_GROUP
PRIMARY_GROUP:x:1004:your-user

Replace PRIMARY_GROUP with whatever your own id -gn printed, never copy the example's numeric ID or member list. To see every group your account already knows about:

$ id -Gn
PRIMARY_GROUP OTHER_GROUP

newgrp changes the real group ID to the one you named, and tries to add that group to the process's groupset too. It reads group membership and passwords from /etc/gshadow when an entry exists there, otherwise from /etc/group, though it never writes to either file itself.

3. Start a Shell With the Selected Group

Run newgrp with the exact group name. It starts another shell, so the command will look like it is hanging while it waits for input:

$ newgrp PRIMARY_GROUP

At the new prompt, check the effective identity:

$ id -g
1004
$ id -gn
PRIMARY_GROUP
$ id -G
1004 27 987 1000 1009 1017

Your numbers and group list will differ, id -gn is the clearest check of the primary group's name. The original shell is still sitting underneath this one, leave the new shell with exit:

$ exit
exit

4. Script the Test Without an Interactive Pause

For a script or a quick diagnostic, feed commands straight into the shell that newgrp starts, keeping the test local and letting you capture the exit status:

$ printf '%s\n' 'id -gn' 'id -g' 'exit' | newgrp PRIMARY_GROUP
PRIMARY_GROUP
1004
$ printf 'newgrp status: %s\n' "$?"
newgrp status: 0

The output values here are placeholders, use your own group name and numeric ID. A zero status means the child shell completed successfully, it does not by itself prove a different group was selected unless the id output also matches what you asked for.

$ TARGET_GROUP='PRIMARY_GROUP'
$ printf '%s\n' 'id -gn' 'exit' | newgrp "$TARGET_GROUP"
PRIMARY_GROUP

5. Understand the Password and Failure Cases

If you are not root, newgrp can ask for a password when you are not a listed member and the target group has one set. A group with an empty password does not grant access to an unlisted user. Never paste a password into a command line or a script, if the prompt catches you off guard, cancel with Ctrl-C and check membership with getent group TARGET_GROUP instead.

An unknown group is a safe negative test, it should fail rather than create anything:

$ printf '%s\n' 'exit' | newgrp definitely-no-such-group-xyz
$ printf 'newgrp status: %s\n' "$?"
newgrp status: 2

The exact diagnostic text can vary, but the non-zero status is what matters. Check spelling and group configuration before reaching for elevated privileges, newgrp cannot create a missing group, and adding membership is an administrator job outside this guide.

6. Decide Whether to Reinitialise the Environment

Without an option, newgrp keeps your current environment and working directory. With a single hyphen, it reinitialises the environment as though you had logged in fresh:

$ newgrp - PRIMARY_GROUP

Only reach for this when you specifically want login-style environment handling, it can make a diagnostic confusing because variables and startup behaviour may not match the parent shell. Verify the result inside the new shell with id -gn, then leave it with exit as before.

There is no persistent undo command here because the normal operation only ever changes the new shell process, exit it and the parent session is exactly as it was. To change default group membership or account configuration for real, use your site's approved identity-management process rather than treating newgrp as an admin tool.