topic Re: NGROUPS_MAX in Operating System - HP-UX

NGROUPS_MAX

gillian bennett_1 — Fri, 27 Sep 2002 03:21:53 GMT

I have just read the thread for setting NGROUPS_MAX. The parameter is not included in tunable parameters, but it is in the header file /usr/include/limits.h. Can this limit be changed and the system rebooted to affect the change?

Thanks, Gillian

Re: NGROUPS_MAX

Steve Steel — Fri, 27 Sep 2002 07:49:18 GMT

Hi

Up to today you cannot change it. see man page
They are constants

limits(5) limits(5)

NAME
limits - implementation-specific constants

SYNOPSIS
#include

DESCRIPTION
The following symbols are defined in and are used
throughout the descriptive text of this manual. The column headed
HP-UX Value lists the values that application writers should assume
for portability across all HP-UX systems.

Steve Steel

Re: NGROUPS_MAX

Ravi_8 — Fri, 27 Sep 2002 08:26:43 GMT

Hi, Gillian.

You can't change the NGROUP_MAX value it's fixed to 20 .
look at the URL
http://forums.itrc.hp.com/cm/QuestionAnswer/1,,0xb4a83fa720f3d5118ff40090279cd0f9,00.html

Re: NGROUPS_MAX

Peter Kloetgen — Fri, 27 Sep 2002 08:27:02 GMT

Hi Gillian,

as allready said, have a look to the manpage for limits. The maximum number of groups has a value of 20 and should *not* be increased.

Allways stay on the bright side of life!

Peter

Re: NGROUPS_MAX

gillian bennett_1 — Sun, 29 Sep 2002 21:48:17 GMT

ok, so everyone says "no", but no one says why this is the case. I have done this successfully on solaris machines, and 20 groups is kinda restrictive. There is a user on our boxes that is already a member of 30 groups ...
So...my next question...why cant it be done. What is affected?

thanks, Gillian

Re: NGROUPS_MAX

doug hosking — Mon, 30 Sep 2002 01:39:37 GMT

You have to understand that many HP-UX applications and libraries as well as the kernel were compiled with the old value. Some of these were provided by HP, while others were likely provided by third party companies. Changing the header file will do nothing to alter them UNLESS you are fortunate enough to control the entire universe of software running on your system and can recompile everything that uses this define at the same time.

If you are ignore this, change the value and are lucky, the change will have no effect. If you are unlucky, and recompile some but not all of the things affected by this define, you may find overflowed buffers and/or use of uninitialized data in various applications. You really don't want to do this.

Let's take a step back and ask how you are using groups. Maybe there's an alternate way to get equivalent functionality without using a large number of groups. For example, access control lists, sudo, etc. may be helpful.