topic Re: Groups of Groups in Operating System - HP-UX

Groups of Groups

IRI Unix Support Tm 3 — Thu, 08 Jul 2004 14:06:36 GMT

Is it possible to add groups to a another group using /etc/group or netgroups?

I'm trying to set up a management group which needs the rights of several different groups.

Re: Groups of Groups

Sundar_7 — Thu, 08 Jul 2004 14:09:31 GMT

Nope that is not possible. /etc/group only recognizes the username as the last field.

So you will have to manually add the user names to the each individual group names.

Re: Groups of Groups

IRI Unix Support Tm 3 — Thu, 08 Jul 2004 14:13:08 GMT

That's about what I figured...

Thanks

Re: Groups of Groups

KapilRaj — Thu, 08 Jul 2004 14:30:46 GMT

I never tried this but "what if I choose same gid for two groups ?"

Kaps

Re: Groups of Groups

RAC_1 — Thu, 08 Jul 2004 14:36:15 GMT

Kapil,

No problems. In fact if there too many users in a group, you can put them in different groups and same gid for them. All system cares about it gid.

So following /etc/group file is OK

test1::23:x1,x2
test2::23:y1,y2

Anil

Re: Groups of Groups

IRI Unix Support Tm 3 — Thu, 08 Jul 2004 14:38:50 GMT

That was going to be my next option...we do that here already so I know it works.

I was just looking for a quicker way

Thanks everyone

Re: Groups of Groups

Jeff Schussele — Thu, 08 Jul 2004 19:06:12 GMT

Hi,

Just remember that the limiter is total group membership - 20 for any one user.
Spelled out in /usr/include/limits.h.

Later,
Jeff

Re: Groups of Groups

support_5 — Thu, 08 Jul 2004 20:24:15 GMT

Is there a way to increase the number of groups a user can be a member of (ie greater than 20)?

- Andrew

Re: Groups of Groups

Jeff Schussele — Thu, 08 Jul 2004 20:28:27 GMT

Sorry - No.
This is one of things that requires a rewrite of the kernel internels itself.
It can be done - but I wouldn't do it...

My $0.02,
Jeff

Re: Groups of Groups

Gary L. Paveza, Jr. — Fri, 09 Jul 2004 06:32:13 GMT

I currently have a enhancement request in with HP regarding this (JAGaf08926). Basically, I've asked that they create a concept similiar to newgrp which allows changing the primary group membership to one of the secondary groups, etc. Since HP is unwilling to increase the number of groups a user can belong to (which was my first request), then make it so that users can belong to multiple groups of groups. For example, one set might be grp1 (primary), grp2, and grp2 which might be good enough for normal activity. However, suppose that user also does stuff with another application on the box and needs access to grpA, grpB, and grpC. The new functionality would allow the user to switch from grp1, grp2, grp3 to grpA, grpB, and grpC. Our problem is that we have 4 applications on our system, each has 6 levels of function (development, test, model office, production, etc). Support people need to be able to perform activities in all of these, but the applications must be separate from each other (rules out "other" permissions - which must be 0 here).

Re: Groups of Groups

support_5 — Sun, 11 Jul 2004 16:53:31 GMT

Interesting. I do think this idea has merit, and I think it should be included in HP-UX, but I don't think it's a good solution to the problem of a limited number of groups a user can belong to. I think the notion has merits of its own besides this which make it useful, I still think HP should increase the number of group, or make it dynamically changeable, perhaps with a kernel parameter or something.

- Andrew Gray