This is the mail archive of the
libc-alpha@sourceware.org
mailing list for the glibc project.
Re: [Libtirpc-devel] Fwd: Re: proposed patch to rpcbind to providefiner-grained security controls than offered by the -i option
On Sat, Dec 18, 2010 at 03:43:54PM -0500, Chuck Lever wrote:
> When we investigated this problem (and I think I remember talking with
> Jeff Layton and Peter Staubach about this at Connectathon 2010), we
> determined that glibc allowed more supplemental groups than the
> protocol and other implementations can support. Sixteen is the
> standard limit. If your application needs to communicate a longer
> list of supplemental groups, it should be using RPCSEC GSS.
getgroups returns "the supplementary group IDs of the calling
process". It's not up to the application how many there are.
So the actual scenario is that if the user belongs to more than 16
groups, anything that uses this code will crash. Doesn't that seem
like a pretty big problem?
--
Daniel Jacobowitz
CodeSourcery