Bug 1412 - Support for users in more than 16 groups on Mac OS X.
Summary: Support for users in more than 16 groups on Mac OS X.
Status: CLOSED FIXED
Alias: None
Product: Portable OpenSSH
Classification: Unclassified
Component: sshd (show other bugs)
Version: 4.7p1
Hardware: Other Mac OS X
: P2 normal
Assignee: Assigned to nobody
URL:
Keywords:
Depends on:
Blocks: V_5_2
  Show dependency treegraph
 
Reported: 2007-12-21 15:19 AEDT by Disco Vince Giffin
Modified: 2009-02-23 13:35 AEDT (History)
2 users (show)

See Also:


Attachments
Fixes issue with users in more than 16 groups. (597 bytes, patch)
2007-12-21 15:19 AEDT, Disco Vince Giffin
no flags Details | Diff
wrap in __APPLE__ and comment (880 bytes, patch)
2009-01-15 11:12 AEDT, Damien Miller
dtucker: ok+
dtucker: ok+
Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Disco Vince Giffin 2007-12-21 15:19:29 AEDT
Created attachment 1407 [details]
Fixes issue with users in more than 16 groups.

Attached is a patch for building OpenSSH 4.7p1 on Mac OS X.

This patch corrects functionality for users in more than 16 groups.
Comment 1 Darren Tucker 2007-12-21 21:42:33 AEDT
Comment on attachment 1407 [details]
Fixes issue with users in more than 16 groups.

>+	if (initgroups(pw->pw_name, pw->pw_gid) < 0)

Why is this necessary?  There's an initgroups() call in session.c.

(and yeah, I know that #ifdef hairball in session.c makes it hard to follow, but I have plans to tidy that up.)
Comment 2 Disco Vince Giffin 2007-12-22 08:54:45 AEDT
(In reply to comment #1)
> Why is this necessary?  There's an initgroups() call in session.c.

Good question.  I'll have to do a little more research to answer that.
I did run a couple of tests and confirmed that this patch is required for scp to honor groups past the 16th (for a given user) for OpenSSH 4.7p1 on Leopard (Mac OS X 10.5.1).
Comment 3 Damien Miller 2008-01-20 06:49:36 AEDT
Comment on attachment 1407 [details]
Fixes issue with users in more than 16 groups.

Seems reasonable to me. Darren, can you see any problems with this?
Comment 4 Darren Tucker 2008-01-20 09:42:24 AEDT
(In reply to comment #3)
> (From update of attachment 1407 [details])
> Seems reasonable to me. Darren, can you see any problems with this?

I'd like to understand why it's needed first, given that there's already an initgroups() call in session.c.
Comment 5 Disco Vince Giffin 2008-01-22 13:19:08 AEDT
This patch should probably be within the #else portion of the above #ifdef and/or within an #ifdef __APPLE__.
Comment 6 Disco Vince Giffin 2008-01-22 13:24:20 AEDT
(In reply to comment #4)
> (In reply to comment #3)
> > (From update of attachment 1407 [details] [details])
> > Seems reasonable to me. Darren, can you see any problems with this?
> 
> I'd like to understand why it's needed first, given that there's
> already an initgroups() call in session.c.

Our (Apple's) implementation of initgroups() opts you in to using memberd (which gives you the ability to be in more than 16 groups).  For conformance and compatibility reasons, certain calls will opt you out of this behavior.  The setgid() call just above this patch opts out of using more than 16 groups.  The patch to call initgroups() again is required to opt back in.  Basically, initgroups has to be called after any setgroups(), setgid(), etc., if you want to use more than 16 groups.
Comment 7 Damien Miller 2009-01-13 18:14:32 AEDT
Won't a similar call to initgroups() need to be in permanently_drop_suid() and restore_uid() too?
Comment 8 Disco Vince Giffin 2009-01-14 09:05:23 AEDT
(In reply to comment #7)
> Won't a similar call to initgroups() need to be in
> permanently_drop_suid() and restore_uid() too?

No, because setgid() isn't called from permanently_drop_suid() and restore_uid() is restoring the original (privileged) uid.
Comment 9 Damien Miller 2009-01-14 13:31:30 AEDT
Sorry, I meant temporarily_use_uid(), not permanently_drop_suid()

temporarily_use_uid() calls setgroups(), does that opt out of memberd?
Comment 10 Disco Vince Giffin 2009-01-15 08:09:08 AEDT
(In reply to comment #9)
> Sorry, I meant temporarily_use_uid(), not permanently_drop_suid()
> 
> temporarily_use_uid() calls setgroups(), does that opt out of memberd?

No.  The call to setgroups() in temporarily_use_uid() should be fine.
Comment 11 Damien Miller 2009-01-15 11:12:26 AEDT
Created attachment 1592 [details]
wrap in __APPLE__ and comment

This is the diff I'd like to commit then.
Comment 12 Damien Miller 2009-01-21 16:08:21 AEDT
fix applied - will be in openssh-5.2. Thanks!
Comment 13 Damien Miller 2009-02-23 13:35:37 AEDT
Close bugs fixed/reviewed for openssh-5.2 release