Re: kern.ngroups (non) setting ... new bounty ?

Previous thread: iSCSI Target and raw devices by Mark Saad on Tuesday, September 25, 2007 - 3:19 pm. (6 messages)

Next thread: none
From: rsync.net
Date: Tuesday, September 25, 2007 - 9:51 am

It has been impossible to change kern.ngroups - at least for several years
now.  It was not fixed in either 5.x or 6.x :

http://lists.freebsd.org/pipermail/freebsd-bugs/2007-January/022140.html

It is seemingly a difficult problem:

http://www.atm.tut.fi/list-archive/freebsd-stable/msg09969.html   [1]

However it should be solved - we can't be the only ones out there trying
to add a UID to more than 16 groups...


-----


The rsync.net code bounties have been fairly successful this year - two of
the five projects have been completed, and the large "vmware 6 on FreeBSD"
project is now underway.

We'd like to add a new bounty for this kern.ngroups issue.  We are posting
to -hackers today to get some feedback on how long this will take and how
much money might reasonably be expected to lure this work.


--rsync.net Support



[1]  Is it indeed true that these programs are broken by not following
     NGROUPS_MAX from syslimits.h?
_______________________________________________
freebsd-hackers@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-hackers
To unsubscribe, send any mail to "freebsd-hackers-unsubscribe@freebsd.org"
From: Pawel Jakub Dawidek
Date: Thursday, September 27, 2007 - 4:09 am

I don't see how they can be broken. They may not see more than 16
groups, but they shouldn't blow up. The only possibility of bad usage I
see is something like this:

	gid_t gids[NGROUPS_MAX];
	int gidsetlen;

	gidsetlen =3D getgroups(0, NULL);
	getgroups(gidsetlen, gids);

But I guess the most common use is:

	gid_t gids[NGROUPS_MAX];
	int gidsetlen;

	gidsetlen =3D getgroups(NGROUPS_MAX, gids);

Binaries using the latter method should be just fine.
BTW. The latter method is what all utilities from the base system use.

--=20
Pawel Jakub Dawidek                       http://www.wheel.pl
pjd@FreeBSD.org                           http://www.FreeBSD.org
FreeBSD committer                         Am I Evil? Yes, I Am!
From: Pietro Cerutti
Date: Thursday, September 27, 2007 - 4:17 am

Anyway, why should we worry about possible breakage software written
with a bad design?

-- 
Pietro Cerutti

PGP Public Key:
http://gahr.ch/pgp
_______________________________________________
freebsd-hackers@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-hackers
To unsubscribe, send any mail to "freebsd-hackers-unsubscribe@freebsd.org"
From: Harti Brandt
Date: Thursday, September 27, 2007 - 4:48 am

On Thu, 27 Sep 2007, Pietro Cerutti wrote:

PC>Pawel Jakub Dawidek wrote:
PC>> On Tue, Sep 25, 2007 at 09:51:06AM -0700, rsync.net wrote:
PC>>> It has been impossible to change kern.ngroups - at least for several years
PC>>> now.  It was not fixed in either 5.x or 6.x :
PC>>>
PC>>> http://lists.freebsd.org/pipermail/freebsd-bugs/2007-January/022140.html
PC>>>
PC>>> It is seemingly a difficult problem:
PC>>>
PC>>> http://www.atm.tut.fi/list-archive/freebsd-stable/msg09969.html   [1]
PC>>>
PC>>> However it should be solved - we can't be the only ones out there trying
PC>>> to add a UID to more than 16 groups...
PC>>>
PC>>>
PC>>> -----
PC>>>
PC>>>
PC>>> The rsync.net code bounties have been fairly successful this year - two of
PC>>> the five projects have been completed, and the large "vmware 6 on FreeBSD"
PC>>> project is now underway.
PC>>>
PC>>> We'd like to add a new bounty for this kern.ngroups issue.  We are posting
PC>>> to -hackers today to get some feedback on how long this will take and how
PC>>> much money might reasonably be expected to lure this work.
PC>>>
PC>>>
PC>>> --rsync.net Support
PC>>>
PC>>>
PC>>>
PC>>> [1]  Is it indeed true that these programs are broken by not following
PC>>>      NGROUPS_MAX from syslimits.h?
PC>> 
PC>> I don't see how they can be broken. They may not see more than 16
PC>> groups, but they shouldn't blow up. The only possibility of bad usage I
PC>> see is something like this:
PC>> 
PC>> 	gid_t gids[NGROUPS_MAX];
PC>> 	int gidsetlen;
PC>> 
PC>> 	gidsetlen = getgroups(0, NULL);
PC>> 	getgroups(gidsetlen, gids);
PC>> 
PC>> But I guess the most common use is:
PC>> 
PC>> 	gid_t gids[NGROUPS_MAX];
PC>> 	int gidsetlen;
PC>> 
PC>> 	gidsetlen = getgroups(NGROUPS_MAX, gids);
PC>> 
PC>> Binaries using the latter method should be just fine.
PC>> BTW. The latter method is what all utilities from the base system use.
PC>> 
PC>
PC>Anyway, why should we worry about possible breakage software written
PC>with a bad design?

We ...
From: John Baldwin
Date: Thursday, September 27, 2007 - 6:26 am

And some sysadmins may use it via 'chmod 606' or the like.

-- 
John Baldwin
_______________________________________________
freebsd-hackers@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-hackers
To unsubscribe, send any mail to "freebsd-hackers-unsubscribe@freebsd.org"
From: Julian Elischer
Date: Wednesday, September 26, 2007 - 11:22 am

the big question is what do you do for NFS?  remember something about

_______________________________________________
freebsd-hackers@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-hackers
To unsubscribe, send any mail to "freebsd-hackers-unsubscribe@freebsd.org"
From: rsync.net
Date: Wednesday, September 26, 2007 - 1:11 pm

Assuming the answer to the above footnote is "yes", would it be reasonable
to fix the OS generally, but continue to hard code the limits in things
like NFS ?

Are you saying that, unlike other items, NFS _does_ respect NGROUPS_MAX ?
_______________________________________________
freebsd-hackers@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-hackers
To unsubscribe, send any mail to "freebsd-hackers-unsubscribe@freebsd.org"
From: Julian Elischer
Date: Wednesday, September 26, 2007 - 2:00 pm

actually it doesn't

see:

nfs/rpcv2.h:#define     RPCAUTH_UNIXGIDS 16

but what do we do if a user has > 16?

_______________________________________________
freebsd-hackers@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-hackers
To unsubscribe, send any mail to "freebsd-hackers-unsubscribe@freebsd.org"
From: rsync.net
Date: Wednesday, September 26, 2007 - 2:21 pm

We have no idea.  All we know is, we need some UIDs to be members of more
than 16 groups, and that is currently impossible.

We are happy to lend financial support to a solution ... however it sounds
like $500 and free rsync.net storage space isn't going to be sufficient ?

Is it unexpected that someone has run into this limit ?
_______________________________________________
freebsd-hackers@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-hackers
To unsubscribe, send any mail to "freebsd-hackers-unsubscribe@freebsd.org"
From: Harti Brandt
Date: Thursday, September 27, 2007 - 7:58 am

On Wed, 26 Sep 2007, rsync.net wrote:

r>
r>
r>On Wed, 26 Sep 2007, Julian Elischer wrote:
r>
r>> >> rsync.net wrote:
r>> >>> It has been impossible to change kern.ngroups - at least for several years
r>> >>> now.  It was not fixed in either 5.x or 6.x :
r>> >>>
r>> >>> http://lists.freebsd.org/pipermail/freebsd-bugs/2007-January/022140.html
r>> >>>
r>> >>> It is seemingly a difficult problem:
r>> >>>
r>> >>> http://www.atm.tut.fi/list-archive/freebsd-stable/msg09969.html   [1]
r>> >>>
r>> >>> However it should be solved - we can't be the only ones out there trying
r>> >>> to add a UID to more than 16 groups...
r>> >> the big question is what do you do for NFS?  remember something about
r>> >> it only having a fixed storage for groups.
r>> >
r>> >
r>> > (snip)
r>> >
r>> >
r>> >>> [1]  Is it indeed true that these programs are broken by not following
r>> >>>      NGROUPS_MAX from syslimits.h?
r>> >
r>> >
r>> > Assuming the answer to the above footnote is "yes", would it be reasonable
r>> > to fix the OS generally, but continue to hard code the limits in things
r>> > like NFS ?
r>> >
r>> > Are you saying that, unlike other items, NFS _does_ respect NGROUPS_MAX ?
r>>
r>> actually it doesn't
r>>
r>> see:
r>>
r>> nfs/rpcv2.h:#define     RPCAUTH_UNIXGIDS 16
r>>
r>> but what do we do if a user has > 16?
r>
r>
r>We have no idea.  All we know is, we need some UIDs to be members of more
r>than 16 groups, and that is currently impossible.
r>
r>We are happy to lend financial support to a solution ... however it sounds
r>like $500 and free rsync.net storage space isn't going to be sufficient ?
r>
r>Is it unexpected that someone has run into this limit ?

I have :-) There is an easy solution: Bump NGROUPS_MAX and recompile 
everything. Be aware that in some cases the group list is truncated: NFS 
and socket credentials (there may be more). I've done this over a year ago 
on my desktop because I'm in 50 groups that come from an active directory.

Making this ...
Previous thread: iSCSI Target and raw devices by Mark Saad on Tuesday, September 25, 2007 - 3:19 pm. (6 messages)

Next thread: none