What is the purpose of group "staff"?

Question

What is the purpose of group "staff"? Interestingly, note that the set user or group ID on execution (s) bit is set.

michael@greenbeanDev:~ $ ls -l /usr
total 72
drwxr-xr-x  2 root root  28672 May 26 13:10 bin
drwxr-xr-x  2 root root   4096 Jan  7  2015 games
drwxr-xr-x 35 root root  20480 May 21 15:36 include
drwxr-xr-x 49 root root   4096 May 26 13:06 lib
drwxrwsr-x 11 root staff  4096 May 26 15:55 local
drwxr-xr-x  2 root root   4096 May 26 13:06 sbin
drwxr-xr-x 99 root root   4096 Apr  5 15:59 share
drwxr-xr-x  2 root root   4096 Jan  7  2015 src
michael@greenbeanDev:~ $ cat /etc/group | grep staff
staff:x:50:
michael@greenbeanDev:~ $ cat /etc/passwd | grep staff
michael@greenbeanDev:~ $ cat /etc/os-release
PRETTY_NAME="Raspbian GNU/Linux 8 (jessie)"
NAME="Raspbian GNU/Linux"
VERSION_ID="8"
VERSION="8 (jessie)"
ID=raspbian
ID_LIKE=debian
HOME_URL="http://www.raspbian.org/"
SUPPORT_URL="http://www.raspbian.org/RaspbianForums"
BUG_REPORT_URL="http://www.raspbian.org/RaspbianBugs"
michael@greenbeanDev:~ $

Answer 1

According to the Debian Wiki:

staff: Allows users to add local modifications to the system (/usr/local) without needing root privileges (note that executables in /usr/local/bin are in the PATH variable of any user, and they may "override" the executables in /bin and /usr/bin with the same name). Compare with group "adm", which is more related to monitoring/security.

Answer 2

This isn't peculiar to Raspbian or even GNU/Linux; evidently it's used on OSX too, although perhaps not the same way. Both operating systems are a form of unix -- I found that OSX question by quickly searching "unix staff group". OSX actually aims for (and receives) certification from SUS and POSIX; the use of staff there may be to comply with the former.

Linux distros are not so certified, however. There's no staff by default on Fedora, so it is probably just the Debian side of the family. The explanation of purpose from their wiki is:

staff: Allows users to add local modifications to the system (/usr/local) without needing root privileges (note that executables in /usr/local/bin are in the PATH variable of any user, and they may "override" the executables in /bin and /usr/bin with the same name). Compare with group "adm", which is more related to monitoring/security.

Which also explains why /usr/local is set that way.

note that the set user or group ID on execution (s) bit is set

This means that files created in that directory will inherit that gid:

GNU Coreutils: Directories and the Set-User-ID and Set-Group-ID Bits

The only difference this makes with a normal umask of 022 (meaning by default, files are created with group write permission masked out) is that it means subdirectories created there (and files, but this is not so relevant) will inherit that gid -- and the standard ones that are there from the beginning are also set 2775 (group writable with gid bit set).

This means anyone in staff should be able to install anything to /usr/local with write access to the standard hierarchy of subdirectories (etc, bin, lib, share).

---

Answer 3

The OSX staff account is for sudoers (and grants many administrative privileges in the whole system generally), and is used in the same way as the wheel group on e.g. FreeBSD, where only members of wheel can su to root. Apart from a few things in /dev, I expect staff is meant to be used like this on raspbian. I recommend making sure staff users are the only ones allowed to sudo on raspbian.