NGROUPS_MAX

[gillian bennett_1]

I have just read the thread for setting NGROUPS_MAX. The parameter is not included in tunable parameters, but it is in the header file /usr/include/limits.h. Can this limit be changed and the system rebooted to affect the change?

Thanks, Gillian

[Steve Steel]

Hi

Up to today you cannot change it. see man page
They are constants


limits(5) limits(5)

NAME
limits - implementation-specific constants

SYNOPSIS
#include

DESCRIPTION
The following symbols are defined in and are used
throughout the descriptive text of this manual. The column headed
HP-UX Value lists the values that application writers should assume
for portability across all HP-UX systems.



Steve Steel

[Ravi_8]

Hi, Gillian.

You can't change the NGROUP_MAX value it's fixed to 20 .
look at the URL
http://forums.itrc.hp.com/cm/QuestionAnswer/1,,0xb4a83fa720f3d5118ff40090279cd0f9,00.html

[Peter Kloetgen]

Hi Gillian,

as allready said, have a look to the manpage for limits. The maximum number of groups has a value of 20 and should *not* be increased.

Allways stay on the bright side of life!

Peter

[gillian bennett_1]

ok, so everyone says "no", but no one says why this is the case. I have done this successfully on solaris machines, and 20 groups is kinda restrictive. There is a user on our boxes that is already a member of 30 groups ...
So...my next question...why cant it be done. What is affected?

thanks, Gillian

[doug hosking]

You have to understand that many HP-UX applications and libraries as well as the kernel were compiled with the old value. Some of these were provided by HP, while others were likely provided by third party companies. Changing the header file will do nothing to alter them UNLESS you are fortunate enough to control the entire universe of software running on your system and can recompile everything that uses this define at the same time.

If you are ignore this, change the value and are lucky, the change will have no effect. If you are unlucky, and recompile some but not all of the things affected by this define, you may find overflowed buffers and/or use of uninitialized data in various applications. You really don't want to do this.

Let's take a step back and ask how you are using groups. Maybe there's an alternate way to get equivalent functionality without using a large number of groups. For example, access control lists, sudo, etc. may be helpful.