I have an executable with user as root and group as ddd
-rwxr-x--- 1 root ddd 30050496 Jan 1 2021 exed
exed will use fd = open(filename, O_CREAT | O_RDWR,0664); and write(fd, buff, size); to write a file to the hard disk. There is no place to change the group of the filename in the source code.
But I found after running the exed, the filename has fff as group. How did this happen? Should the file's group be ddd?
-rw-rw---- 1 root fff 11236167 Nov 13 04:28 filename
The file's owner will be the effective UID of the process that creates it, and the group will be the effective GID of the process.
The exception is if the directory where the file is created has the setgid permission bit set. Then the group will be the group of the directory.