PTS_CREATEGROUP(1)

📦
version 1.8.16.1 · 10 versions
, in ubuntu stonking

✨ PTS_CREATEGROUP(1) — AFS Command Reference ✨

okay bestie, pull up a chair, because this is the page for pts_creategroup, aka the glow-up moment where a brand new group entry gets born in the Protection Database 💅 it's empty when it arrives (iconic, we love a blank slate) but it's yours now.

🎀 NAME 🎀

pts_creategroup — creates an (empty) Protection Database group entry. that's it, that's the whole vibe 🦋

🌸 SYNOPSIS 🌸

pts creategroup -name <group name>+
    [-owner <owner of the group>]
    [-id <id (negated) for the group>+] [-cell <cell name>]
    [-noauth] [-localauth] [-force] [-help]
    [-auth] [-encrypt] [-config <config directory>]

pts createg -na <group name>+  [-o <owner of the group>]
    [-i <id (negated) for the group>+] [-c <cell name>]
    [-no] [-l] [-f] [-h]
    [-a] [-e] [-co <config directory>]

pts cg -na <group name>+ [-o <owner of the group>]
    [-i <id (negated) for the group>+] [-c <cell name>]
    [-no] [-l] [-f] [-h]
    [-a] [-e] [-co <config directory>]

three ways in, all serving the same fantasy ✨ pick whichever abbreviation you're feeling today.

💖 DESCRIPTION 💖

so pts creategroup makes an entry in the Protection Database for each group you name with the -name argument. one command, many groups, no cap. and it writes down you — the issuer of the command — as the group's creator, and also as the group's owner, UNLESS you pass -owner and name some alternate user or group for the crown 👑

there are two types of groups, and this matters:

  • regular — the names of these have two parts separated by a colon. the part before the colon names the group's owner. any user can create these, like genuinely anyone, go off 💅
  • prefix-less — these do NOT have an owner prefix. only members of the system:administrators group can create prefix-less groups. it's giving VIP room energy 🚫 not for everybody.

and here's the thing — creating a group lowers the issuer's group-creation quota by one. yep, even if you used -owner to hand ownership to an alternate user or group, your quota still takes the hit. 😭 want to check a user's group-creation quota? that's pts examine. want to set it? that's pts setfields. iykyk.

now, the AFS group ID (AFS GID) lore: AFS GIDs are negative integers, and by default the Protection Server hands out a GID that is one less (more negative) than the current value of the "max group id" counter in the Protection Database, decrementing the counter by one for each group. so it just keeps going down, down, down 📉 members of system:administrators can use the -id argument to assign specific AFS GID numbers instead. and if any of the specified GIDs is lower (more negative) than the current value of the "max group id" counter, the counter gets reset to that value. it's also acceptable to specify a GID greater (less negative) than the current value of the counter, but the creation operation fails if an existing group already has it 💀. to display or set the value of the "max group id" counter, use pts listmax or pts setmax respectively.

✨ OUTPUT ✨

for each group that gets created, the command generates this exact string to confirm it. so satisfying, fr fr:

group <name> has id <AFS GID>

⚠️ CAUTIONS ⚠️

okay so real talk — you can use the -owner argument to designate a machine entry as a group's owner, and it will not generate an error. but it is not recommended. why? because the Protection Server does not extend the usual privileges of group ownership to users logged onto the machine. so like, no error, but also no perks. don't do it unless you know exactly why you're doing it 🙈

👑 OPTIONS 👑

  • -name <group name> — specifies the name of each group to create. give it a string of up to 63 characters, which can include lowercase (but not uppercase) letters, numbers, and punctuation marks. a regular name includes a single colon (":") to separate the two parts of the name; that colon cannot appear in a prefix-less group name. 🍓

a regular group's name must have the following format:

<owner_name>:<group_name>

and the <owner_name> field must reflect the actual owner of the group, like this:

  • if the optional -owner argument is not included, the field must match the AFS username under which the issuer is currently authenticated.
  • if the -owner argument names an alternate AFS user, the field must match that AFS username.
  • if the -owner argument names another regular group, the field must match the owning group's owner field (the part of its name before the colon). if the -owner argument names a prefix-less group, the field must match the owning group's complete name.
  • -owner <owner of the group> — specifies a user or group as the owner for each group, instead of making the issuer of the command the owner. provide either an AFS username, or the name of a regular or prefix-less group. an owning group must already have at least one member. this requirement exists so nobody can assign self-ownership to a group while it's being created — if you want that, use the pts chown command after running this one. main character energy, but sequentially 🌈
  • -id <id for the group> — specifies a negative integer AFS GID number for each group, instead of letting the Protection Server assign it. precede the integer with a hyphen ("-") to show that it's negative.

if you use this argument and -name names multiple new groups, it's best to provide an equivalent number of AFS GIDs. first GID goes to the first group, second to the second group, and so on, matching them up in order 💫 if there are fewer GIDs than groups, the Protection Server assigns GIDs to the unmatched groups based on the "max group id" counter. if there are more GIDs than groups, the excess GIDs are ignored. and if any of the GIDs is lower (more negative) than the current value of the "max group id" counter, the counter gets reset to that value.

  • -auth — use the calling user's tokens to communicate with the Protection Server. for more details, see pts(1).
  • -cell <cell name> — names the cell in which to run the command. for more details, see pts(1).
  • -config <config directory> — use an alternate config directory. for more details, see pts(1).
  • -encrypt — encrypts any communication with the Protection Server. for more details, see pts(1). 🔒
  • -force — enables the command to continue executing as far as possible when errors or other problems occur, rather than halting execution at the first error. keep going, bestie 🫶
  • -help — prints the online help for this command. all other valid options are ignored.
  • -localauth — constructs a server ticket using a key from the local /etc/openafs/server/KeyFile file. do not combine this flag with the -cell or -noauth options. for more details, see pts(1).
  • -noauth — assigns the unprivileged identity anonymous to the issuer. for more details, see pts(1).

🌟 EXAMPLES 🌟

in the following example, the user pat creates groups called "pat:friends" and "pat:colleagues". two groups, one command, ate ✨

% pts creategroup -name pat:friends pat:colleagues

the following example shows a member of the system:administrators group creating the prefix-less group "staff" and assigning its ownership to the system:administrators group rather than to herself:

% pts creategroup -name staff -owner system:administrators

in the following example, the user pat creates a group called "smith:team-members", which is allowed because the -owner argument specifies the required value ("smith"):

% pts creategroup -name smith:team-members -owner smith

🔐 PRIVILEGE REQUIRED 🔐

the issuer must belong to the system:administrators group to create prefix-less groups, or to include the -id argument.

to create a regular group, the issuer must:

  • be authenticated. the command fails if the -noauth flag is provided. 💀
  • have a group-creation quota greater than zero. the pts examine command displays this quota.

🦋 SEE ALSO 🦋

pts(1), pts_examine(1), pts_listmax(1), pts_setfields(1), pts_setmax(1)

IBM Corporation 2000. <http://www.ibm.com/> All Rights Reserved.

this documentation is covered by the IBM Public License Version 1.0. it was converted from HTML to POD by software written by Chas Williams and Russ Allbery, based on work by Alf Wachsmann and Elizabeth Cassell.

and that's the whole page, bestie 🎀 this one's from the OpenAFS crew, dated 2026-07-27, and honestly? iconic behavior. now go make some groups, you've got this 👑💖

📦 where this page comes from