critical impact:

setgroups, getgroups - NGROUPS_MAX constant value is different (CrCh63)

Problem description

On HPUX 11i v3, the number of groups that may be returned by the getgroups system call or passed to the setgroups system call is no longer limited by the NGROUPS_MAX compile time constant.

The NGROUPS_MAX constant has different values on Tru64 UNIX and HP-UX.

On Tru64 UNIX, the setgroups function sets the group access list, while the getgroups function gets the supplementary group IDs of the current process. The system calls are as follows:

int setgroups ( int gidsetsize, gid_t grouplist[] );
int getgroups ( int gidsetsize, gid_t grouplist[] );

The gidsetsize parameter indicates the number of entries in the array pointed pointed to by the grouplist parameter. This number must not be greater than NGROUPS_MAX.

The NGROUPS_MAX constant is defined in the header file as follows:

#define NGROUPS_MAX 32

On HP-UX, NGROUPS_MAX is defined in the header file as follows:

#define NGROUPS_MAX 20

Identifiers

getgroups

NGROUPS_MAX

setgroups

See also

• Background information on capacity scaling and limits issues impacts
• Background information on kernel impacts
• Background information on security related issues impacts
• getgroups(2)
• setgroups(2)

Solution description

On HPUX 11i v3, The number of groups that may be returned by the getgroups system call or passed to the setgroups system call is no longer limited by the NGROUPS_MAX compile time constant. Programs should use sysconf system call with _SC_NGROUPS_MAX as parameter, to determine the maximum number of groups that may be returned. This can also be used on prior versions of HP-UX.

The actual limit will be returned by sysconf(_SC_NGROUPS_MAX). This value will never be smaller than the current value of NGROUPS_MAX (20).

A future release of HP-UX may permit system administrators to raise the maximum number of groups above the current value of NGROUPS_MAX (20).

In such a system, Applications passing NGROUPS_MAX to getgroups will get a return value of -1 with errno set to EINVAL when called from a process that belongs to more than 20 groups.

Applications passing more than NGROUPS_MAX (but no more than sysconf(_SC_NGROUPS_MAX) groups to setgroups will succeed where they previously would have failed with -1 and errno set to EINVAL.

Review the applicable manpages and your code to determine if your code has dependencies on the value of the NGROUPS_MAX constant.

See also

• getgroups(2)
• setgroups(2)

Problem summary