lkml.org 
[lkml]   [2002]   [Oct]   [22]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [BK PATCH 1/4] fix NGROUPS hard limit (resend)
On Tue, Oct 22, 2002 at 01:03:47PM -0500, Jesse Pollard wrote:

> And I really doubt that anybody has 10000 unique groups (or even
> close to that) running under any system. The center I'm at has
> some of the largest UNIX systems ever made, and there are only
> about 600 unique groups over the entire center. The largest number
> of groups a user can be in is 32. And nobody even comes close.

It happens. We have a bunch of webservers with the web user in thousands
of groups, and we ran into the per-process limit a long, long time ago.
My solution was a bit simpler, however:

static int supplemental_group_member(gid_t grp)
{
int i = current->ngroups;

+ if (current->uid == 80)
+ if (grp >= 1000)
+ return 1;

O:)

This allows us to have a group-per-user policy where the web server has
access to each user's files without allowing any user to have access to
files belonging to any other user, which is quite useful.

Simon-

[ Simon Kirby ][ Network Operations ]
[ sim@netnation.com ][ NetNation Communications ]
[ Opinions expressed are not necessarily those of my employer. ]
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 13:30    [W:0.098 / U:0.816 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site