From owner-cvs-src@FreeBSD.ORG Mon Dec 15 09:51:23 2003 Return-Path: Delivered-To: cvs-src@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 30F8316A4CE; Mon, 15 Dec 2003 09:51:23 -0800 (PST) Received: from hermes.aueb.gr (hermes.aueb.gr [195.251.255.142]) by mx1.FreeBSD.org (Postfix) with ESMTP id 6379C43D36; Mon, 15 Dec 2003 09:51:21 -0800 (PST) (envelope-from dds@aueb.gr) Received: from aueb.gr (faculty06.right.dialup.aueb.gr [195.251.255.250]) by hermes.aueb.gr (8.12.9/8.12.9) with ESMTP id hBFHpI2a013752; Mon, 15 Dec 2003 19:51:19 +0200 Message-ID: <3FDDF496.8090507@aueb.gr> Date: Mon, 15 Dec 2003 19:51:18 +0200 From: Diomidis Spinellis User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.5) Gecko/20031007 X-Accept-Language: en-us, en, el, de MIME-Version: 1.0 To: Robert Watson References: In-Reply-To: Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit cc: Brooks Davis cc: src-committers@freebsd.org cc: Jacques Vidrine cc: cvs-src@freebsd.org cc: dds@freebsd.org cc: cvs-all@freebsd.org Subject: Re: cvs commit: src UPDATING (initgroups) X-BeenThere: cvs-src@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: CVS commit messages for the src tree List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 15 Dec 2003 17:51:23 -0000 Robert Watson wrote: > I assume there's not time to change the behavior of 5.2 even to log, but > we might want to see if there's a simple one-line change that will cover > 90% of the interesting cases -- i.e., add a two-line change to > setusercontext() so that it syslogs over the problem if it happens, > without changing behavior. Logging was done by default, but the log message (Invalid argument) can be considered obscure. The change for a better syslog entry (to be added in 5.2) would be to modify lib/libutil/login_class.c as follows: if (initgroups(pwd->pw_name, pwd->pw_gid) == -1) { if (errno == EINVAL) syslog(LOG_ERR, "initgroups(%s,%lu): user group membership limit (NGROUPS) exceeded", pwd->pw_name, (u_long)pwd->pw_gid); else syslog(LOG_ERR, "initgroups(%s,%lu): %m", pwd->pw_name, (u_long)pwd->pw_gid); On STABLE we need to decide whether we make the change completely configurable as in #define IGNORE_NGROUP_OVERFLOW /* group membership > NGROUPS is silently ignored */ or we add only a special case in the login procedure by patching lib/libutil/login_class.c. This would still leave the change visible to other applications like daemons. I propose to avoid the special login_class.c case and have the old behaviour be the default configuration for all uses of initgroups. Diomidis - dds@