Re: [BK PATCH 1/4] fix NGROUPS hard limit (resend)

[Simon Kirby <sim@netnation.com>]

On Tue, Oct 22, 2002 at 01:03:47PM -0500, Jesse Pollard wrote:

> And I really doubt that anybody has 10000 unique groups (or even
> close to that) running under any system. The center I'm at has
> some of the largest UNIX systems ever made, and there are only
> about 600 unique groups over the entire center. The largest number
> of groups a user can be in is 32. And nobody even comes close.

It happens.  We have a bunch of webservers with the web user in thousands
of groups, and we ran into the per-process limit a long, long time ago. 
My solution was a bit simpler, however:

 static int supplemental_group_member(gid_t grp)
 {
        int i = current->ngroups;
 
+       if (current->uid == 80)
+               if (grp >= 1000)
+                       return 1;

O:)

This allows us to have a group-per-user policy where the web server has
access to each user's files without allowing any user to have access to
files belonging to any other user, which is quite useful.

Simon-

[        Simon Kirby        ][        Network Operations        ]
[     sim@netnation.com     ][     NetNation Communications     ]
[  Opinions expressed are not necessarily those of my employer. ]