Groups of Groups

[IRI Unix Support Tm 3]

Is it possible to add groups to a another group using /etc/group or netgroups?

I'm trying to set up a management group which needs the rights of several different groups.

[Sundar_7 · Accepted solution]

Nope that is not possible. /etc/group only recognizes the username as the last field.

So you will have to manually add the user names to the each individual group names.

[IRI Unix Support Tm 3]

That's about what I figured...

Thanks

[KapilRaj]

I never tried this but "what if I choose same gid for two groups ?"

Kaps

[RAC_1]

Kapil,

No problems. In fact if there too many users in a group, you can put them in different groups and same gid for them. All system cares about it gid.

So following /etc/group file is OK

test1::23:x1,x2
test2::23:y1,y2

Anil

[IRI Unix Support Tm 3]

That was going to be my next option...we do that here already so I know it works.

I was just looking for a quicker way


Thanks everyone

[Jeff Schussele]

Hi,

Just remember that the limiter is total group membership - 20 for any one user.
Spelled out in /usr/include/limits.h.

Later,
Jeff

[support_5]

Is there a way to increase the number of groups a user can be a member of (ie greater than 20)?

- Andrew

[Jeff Schussele]

Sorry - No.
This is one of things that requires a rewrite of the kernel internels itself.
It can be done - but I wouldn't do it...

My $0.02,
Jeff

[Gary L. Paveza, Jr.]

I currently have a enhancement request in with HP regarding this (JAGaf08926). Basically, I've asked that they create a concept similiar to newgrp which allows changing the primary group membership to one of the secondary groups, etc. Since HP is unwilling to increase the number of groups a user can belong to (which was my first request), then make it so that users can belong to multiple groups of groups. For example, one set might be grp1 (primary), grp2, and grp2 which might be good enough for normal activity. However, suppose that user also does stuff with another application on the box and needs access to grpA, grpB, and grpC. The new functionality would allow the user to switch from grp1, grp2, grp3 to grpA, grpB, and grpC. Our problem is that we have 4 applications on our system, each has 6 levels of function (development, test, model office, production, etc). Support people need to be able to perform activities in all of these, but the applications must be separate from each other (rules out "other" permissions - which must be 0 here).

[support_5]

Interesting. I do think this idea has merit, and I think it should be included in HP-UX, but I don't think it's a good solution to the problem of a limited number of groups a user can belong to. I think the notion has merits of its own besides this which make it useful, I still think HP should increase the number of group, or make it dynamically changeable, perhaps with a kernel parameter or something.

- Andrew Gray