It has been impossible to change kern.ngroups - at least for several years now. It was not fixed in either 5.x or 6.x : http://lists.freebsd.org/pipermail/freebsd-bugs/2007-January/022140.html It is seemingly a difficult problem: http://www.atm.tut.fi/list-archive/freebsd-stable/msg09969.html [1] However it should be solved - we can't be the only ones out there trying to add a UID to more than 16 groups... ----- The rsync.net code bounties have been fairly successful this year - two of the five projects have been completed, and the large "vmware 6 on FreeBSD" project is now underway. We'd like to add a new bounty for this kern.ngroups issue. We are posting to -hackers today to get some feedback on how long this will take and how much money might reasonably be expected to lure this work. --rsync.net Support [1] Is it indeed true that these programs are broken by not following NGROUPS_MAX from syslimits.h? _______________________________________________ freebsd-hackers@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-hackers To unsubscribe, send any mail to "freebsd-hackers-unsubscribe@freebsd.org"
I don't see how they can be broken. They may not see more than 16 groups, but they shouldn't blow up. The only possibility of bad usage I see is something like this: gid_t gids[NGROUPS_MAX]; int gidsetlen; gidsetlen =3D getgroups(0, NULL); getgroups(gidsetlen, gids); But I guess the most common use is: gid_t gids[NGROUPS_MAX]; int gidsetlen; gidsetlen =3D getgroups(NGROUPS_MAX, gids); Binaries using the latter method should be just fine. BTW. The latter method is what all utilities from the base system use. --=20 Pawel Jakub Dawidek http://www.wheel.pl pjd@FreeBSD.org http://www.FreeBSD.org FreeBSD committer Am I Evil? Yes, I Am!
Anyway, why should we worry about possible breakage software written with a bad design? -- Pietro Cerutti PGP Public Key: http://gahr.ch/pgp _______________________________________________ freebsd-hackers@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-hackers To unsubscribe, send any mail to "freebsd-hackers-unsubscribe@freebsd.org"
On Thu, 27 Sep 2007, Pietro Cerutti wrote: PC>Pawel Jakub Dawidek wrote: PC>> On Tue, Sep 25, 2007 at 09:51:06AM -0700, rsync.net wrote: PC>>> It has been impossible to change kern.ngroups - at least for several years PC>>> now. It was not fixed in either 5.x or 6.x : PC>>> PC>>> http://lists.freebsd.org/pipermail/freebsd-bugs/2007-January/022140.html PC>>> PC>>> It is seemingly a difficult problem: PC>>> PC>>> http://www.atm.tut.fi/list-archive/freebsd-stable/msg09969.html [1] PC>>> PC>>> However it should be solved - we can't be the only ones out there trying PC>>> to add a UID to more than 16 groups... PC>>> PC>>> PC>>> ----- PC>>> PC>>> PC>>> The rsync.net code bounties have been fairly successful this year - two of PC>>> the five projects have been completed, and the large "vmware 6 on FreeBSD" PC>>> project is now underway. PC>>> PC>>> We'd like to add a new bounty for this kern.ngroups issue. We are posting PC>>> to -hackers today to get some feedback on how long this will take and how PC>>> much money might reasonably be expected to lure this work. PC>>> PC>>> PC>>> --rsync.net Support PC>>> PC>>> PC>>> PC>>> [1] Is it indeed true that these programs are broken by not following PC>>> NGROUPS_MAX from syslimits.h? PC>> PC>> I don't see how they can be broken. They may not see more than 16 PC>> groups, but they shouldn't blow up. The only possibility of bad usage I PC>> see is something like this: PC>> PC>> gid_t gids[NGROUPS_MAX]; PC>> int gidsetlen; PC>> PC>> gidsetlen = getgroups(0, NULL); PC>> getgroups(gidsetlen, gids); PC>> PC>> But I guess the most common use is: PC>> PC>> gid_t gids[NGROUPS_MAX]; PC>> int gidsetlen; PC>> PC>> gidsetlen = getgroups(NGROUPS_MAX, gids); PC>> PC>> Binaries using the latter method should be just fine. PC>> BTW. The latter method is what all utilities from the base system use. PC>> PC> PC>Anyway, why should we worry about possible breakage software written PC>with a bad design? We ...
And some sysadmins may use it via 'chmod 606' or the like. -- John Baldwin _______________________________________________ freebsd-hackers@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-hackers To unsubscribe, send any mail to "freebsd-hackers-unsubscribe@freebsd.org"
the big question is what do you do for NFS? remember something about _______________________________________________ freebsd-hackers@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-hackers To unsubscribe, send any mail to "freebsd-hackers-unsubscribe@freebsd.org"
Assuming the answer to the above footnote is "yes", would it be reasonable to fix the OS generally, but continue to hard code the limits in things like NFS ? Are you saying that, unlike other items, NFS _does_ respect NGROUPS_MAX ? _______________________________________________ freebsd-hackers@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-hackers To unsubscribe, send any mail to "freebsd-hackers-unsubscribe@freebsd.org"
actually it doesn't see: nfs/rpcv2.h:#define RPCAUTH_UNIXGIDS 16 but what do we do if a user has > 16? _______________________________________________ freebsd-hackers@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-hackers To unsubscribe, send any mail to "freebsd-hackers-unsubscribe@freebsd.org"
We have no idea. All we know is, we need some UIDs to be members of more than 16 groups, and that is currently impossible. We are happy to lend financial support to a solution ... however it sounds like $500 and free rsync.net storage space isn't going to be sufficient ? Is it unexpected that someone has run into this limit ? _______________________________________________ freebsd-hackers@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-hackers To unsubscribe, send any mail to "freebsd-hackers-unsubscribe@freebsd.org"
On Wed, 26 Sep 2007, rsync.net wrote: r> r> r>On Wed, 26 Sep 2007, Julian Elischer wrote: r> r>> >> rsync.net wrote: r>> >>> It has been impossible to change kern.ngroups - at least for several years r>> >>> now. It was not fixed in either 5.x or 6.x : r>> >>> r>> >>> http://lists.freebsd.org/pipermail/freebsd-bugs/2007-January/022140.html r>> >>> r>> >>> It is seemingly a difficult problem: r>> >>> r>> >>> http://www.atm.tut.fi/list-archive/freebsd-stable/msg09969.html [1] r>> >>> r>> >>> However it should be solved - we can't be the only ones out there trying r>> >>> to add a UID to more than 16 groups... r>> >> the big question is what do you do for NFS? remember something about r>> >> it only having a fixed storage for groups. r>> > r>> > r>> > (snip) r>> > r>> > r>> >>> [1] Is it indeed true that these programs are broken by not following r>> >>> NGROUPS_MAX from syslimits.h? r>> > r>> > r>> > Assuming the answer to the above footnote is "yes", would it be reasonable r>> > to fix the OS generally, but continue to hard code the limits in things r>> > like NFS ? r>> > r>> > Are you saying that, unlike other items, NFS _does_ respect NGROUPS_MAX ? r>> r>> actually it doesn't r>> r>> see: r>> r>> nfs/rpcv2.h:#define RPCAUTH_UNIXGIDS 16 r>> r>> but what do we do if a user has > 16? r> r> r>We have no idea. All we know is, we need some UIDs to be members of more r>than 16 groups, and that is currently impossible. r> r>We are happy to lend financial support to a solution ... however it sounds r>like $500 and free rsync.net storage space isn't going to be sufficient ? r> r>Is it unexpected that someone has run into this limit ? I have :-) There is an easy solution: Bump NGROUPS_MAX and recompile everything. Be aware that in some cases the group list is truncated: NFS and socket credentials (there may be more). I've done this over a year ago on my desktop because I'm in 50 groups that come from an active directory. Making this ...
