Limit on Secondary groups

Another limit implication from the Solaris 8 documentation:
--------------8X----------------
There are some useful limitations of groupids. For example, each user account can be in no more than 16 groups, and a line in the group file cannot exceed 512 characters (including the newline character).

What happens if you need to add so many members to a group that you exceed the 512-character entry limit? You simply create another duplicate group entry—same name and group number—and list the additional members there.
--------------8X----------------

If there is a problem at 512 chars, then follow the above advice about a duplicate line.

HTH:)

On a redhat system (RHEL 3) , the max total number of groups that you can have on a system is 65535:

/proc/sys/kernel/overflowgid

This gives the max gid number, so obviously there can't be more groups than this, unless you decide to recompile your kernel to give a bigger number. As a result (obviously), you can't have more than 65533 secondary groups. (Obviously being part of root (0), makes the rest of the groups fairly pointless, and one of the groups would have to be a primary group for the user).


HTH:)

ravenpl,

I'm not finding that file in RHEL ES3U7.

/proc/sys/kernel/overflowgid
is the maximum numbers of groups in the system - not per user / process.

pjedmond,

There's no need for the limit - I'm just trying to find out what it might be. I agree, POSIX says there's no limit, but in practice we do see limits - either ones imposed by a file parser (a la Solaris 8) or by the maximum # of groups the system supports (a la /proc/sys/kernel/overflowgid).

100 is quite sufficient, in any case.

I also wonder about breaking apps that pay attention to Secondary Groups, like sudo, or OpenSSH (specifically the AllowGroups/DenyGroups keywords in sshd_config).

(67 groups)  :)

Also to be clear here - the limit applies to the the process. You can put user in as many groups as You want, but when it executes an application, the process can be a member of ngroups secondary groups.

Good point.

Unfortunately, I can't find much in the way of specific documentation, and I guess that means that the best possible test would be to try it and see. Of course if PAM is used rather than the default authentication options, then it is more than probable that the limits will be different:)

#include <stdio.h>
#include <sys/types.h>
#include <unistd.h>
#include <grp.h>
int main()
{
 int i = 1;
 gid_t li[100000];
 while(setgroups(i, li) == 0) ++i;
 printf("failed on %d\n", i);
 return 0;
}
//shows the limit(hence may get SIGSEGV if the limit is greater than 100000). I suppose it's end of topic.

expect long execution on 2.6 kernel ;) the limit is 64K...

PAM is not in use.

Yes, the kernel is v2.4 for RHEL v3. So it sounds like the *practical* limit is 32.

Is that enough for your needs? If not, then you've still got the PAM option:)