Replace the static NGROUPS=NGROUPS_MAX+1=1024 with a dynamic

kern.ngroups+1.  kern.ngroups can range from NGROUPS_MAX=1023 to
INT_MAX-1.  Given that the Windows group limit is 1024, this range
should be sufficient for most applications.

MFC after:	1 month

11 files changed, 33 insertions, 17 deletions

diff --git a/sys/boot/forth/loader.conf b/sys/boot/forth/loader.conf
index 44eef5f..523a2f7 100644
--- a/sys/boot/forth/loader.conf
+++ b/sys/boot/forth/loader.conf
@@ -101,6 +101,7 @@ module_path="/boot/modules"	# Set the module search path
 #kern.maxusers="32"		# Set size of various static tables
 #kern.nbuf=""			# Set the number of buffer headers
 #kern.ncallout=""		# Set the maximum # of timer events
+#kern.ngroups="1023"		# Set the maximum # of supplemental groups
 #kern.sgrowsiz=""		# Set the amount to grow stack
 #kern.cam.scsi_delay="2000"	# Delay (in ms) before probing SCSI
 #kern.ipc.maxsockets=""		# Set the maximum number of sockets avaliable
diff --git a/sys/compat/linux/linux_misc.c b/sys/compat/linux/linux_misc.c
index 1d5eaf8..7ea1243 100644
--- a/sys/compat/linux/linux_misc.c
+++ b/sys/compat/linux/linux_misc.c
@@ -1138,7 +1138,7 @@ linux_setgroups(struct thread *td, struct linux_setgroups_args *args)
 	struct proc *p;
 
 	ngrp = args->gidsetsize;
-	if (ngrp < 0 || ngrp >= NGROUPS)
+	if (ngrp < 0 || ngrp > ngroups_max)
 		return (EINVAL);
 	linux_gidset = malloc(ngrp * sizeof(*linux_gidset), M_TEMP, M_WAITOK);
 	error = copyin(args->grouplist, linux_gidset, ngrp * sizeof(l_gid_t));
diff --git a/sys/compat/linux/linux_uid16.c b/sys/compat/linux/linux_uid16.c
index b49bf78..7bbfc8d 100644
--- a/sys/compat/linux/linux_uid16.c
+++ b/sys/compat/linux/linux_uid16.c
@@ -109,7 +109,7 @@ linux_setgroups16(struct thread *td, struct linux_setgroups16_args *args)
 #endif
 
 	ngrp = args->gidsetsize;
-	if (ngrp < 0 || ngrp >= NGROUPS)
+	if (ngrp < 0 || ngrp > ngroups_max)
 		return (EINVAL);
 	linux_gidset = malloc(ngrp * sizeof(*linux_gidset), M_TEMP, M_WAITOK);
 	error = copyin(args->gidset, linux_gidset, ngrp * sizeof(l_gid16_t));
diff --git a/sys/compat/svr4/svr4_misc.c b/sys/compat/svr4/svr4_misc.c
index 62bd010..6f80fe6 100644
--- a/sys/compat/svr4/svr4_misc.c
+++ b/sys/compat/svr4/svr4_misc.c
@@ -708,7 +708,7 @@ svr4_sys_sysconfig(td, uap)
 
 	switch (uap->name) {
 	case SVR4_CONFIG_NGROUPS:
-		*retval = NGROUPS_MAX;
+		*retval = ngroups_max;
 		break;
 	case SVR4_CONFIG_CHILD_MAX:
 		*retval = maxproc;
diff --git a/sys/i386/ibcs2/ibcs2_misc.c b/sys/i386/ibcs2/ibcs2_misc.c
index 23c617d..6d25937 100644
--- a/sys/i386/ibcs2/ibcs2_misc.c
+++ b/sys/i386/ibcs2/ibcs2_misc.c
@@ -665,7 +665,7 @@ ibcs2_getgroups(td, uap)
 
 	if (uap->gidsetsize < 0)
 		return (EINVAL);
-	ngrp = MIN(uap->gidsetsize, NGROUPS);
+	ngrp = MIN(uap->gidsetsize, ngroups_max + 1);
 	gp = malloc(ngrp * sizeof(*gp), M_TEMP, M_WAITOK);
 	error = kern_getgroups(td, &ngrp, gp);
 	if (error)
@@ -693,7 +693,7 @@ ibcs2_setgroups(td, uap)
 	gid_t *gp;
 	int error, i;
 
-	if (uap->gidsetsize < 0 || uap->gidsetsize > NGROUPS)
+	if (uap->gidsetsize < 0 || uap->gidsetsize > ngroups_max + 1)
 		return (EINVAL);
 	if (uap->gidsetsize && uap->gidset == NULL)
 		return (EINVAL);
diff --git a/sys/kern/kern_mib.c b/sys/kern/kern_mib.c
index 78382c7..e2d061a 100644
--- a/sys/kern/kern_mib.c
+++ b/sys/kern/kern_mib.c
@@ -125,7 +125,7 @@ SYSCTL_INT(_kern, KERN_POSIX1, posix1version, CTLFLAG_RD,
     0, _POSIX_VERSION, "Version of POSIX attempting to comply to");
 
 SYSCTL_INT(_kern, KERN_NGROUPS, ngroups, CTLFLAG_RD,
-    0, NGROUPS_MAX,
+    &ngroups_max, 0,
     "Maximum number of supplemental groups a user can belong to");
 
 SYSCTL_INT(_kern, KERN_JOB_CONTROL, job_control, CTLFLAG_RD,
diff --git a/sys/kern/kern_prot.c b/sys/kern/kern_prot.c
index 709bcb0..5a5c24c 100644
--- a/sys/kern/kern_prot.c
+++ b/sys/kern/kern_prot.c
@@ -283,7 +283,7 @@ getgroups(struct thread *td, register struct getgroups_args *uap)
 	u_int ngrp;
 	int error;
 
-	ngrp = MIN(uap->gidsetsize, NGROUPS);
+	ngrp = MIN(uap->gidsetsize, ngroups_max + 1);
 	groups = malloc(ngrp * sizeof(*groups), M_TEMP, M_WAITOK);
 	error = kern_getgroups(td, &ngrp, groups);
 	if (error)
@@ -796,7 +796,7 @@ setgroups(struct thread *td, struct setgroups_args *uap)
 	gid_t *groups = NULL;
 	int error;
 
-	if (uap->gidsetsize > NGROUPS)
+	if (uap->gidsetsize > ngroups_max + 1)
 		return (EINVAL);
 	groups = malloc(uap->gidsetsize * sizeof(gid_t), M_TEMP, M_WAITOK);
 	error = copyin(uap->gidset, groups, uap->gidsetsize * sizeof(gid_t));
@@ -815,7 +815,7 @@ kern_setgroups(struct thread *td, u_int ngrp, gid_t *groups)
 	struct ucred *newcred, *oldcred;
 	int error;
 
-	if (ngrp > NGROUPS)
+	if (ngrp > ngroups_max + 1)
 		return (EINVAL);
 	AUDIT_ARG_GROUPSET(groups, ngrp);
 	newcred = crget();
@@ -2022,14 +2022,14 @@ crsetgroups_locked(struct ucred *cr, int ngrp, gid_t *groups)
 
 /*
  * Copy groups in to a credential after expanding it if required.
- * Truncate the list to NGROUPS if it is too large.
+ * Truncate the list to (ngroups_max + 1) if it is too large.
  */
 void
 crsetgroups(struct ucred *cr, int ngrp, gid_t *groups)
 {
 
-	if (ngrp > NGROUPS)
-		ngrp = NGROUPS;
+	if (ngrp > ngroups_max + 1)
+		ngrp = ngroups_max + 1;
 
 	crextend(cr, ngrp);
 	crsetgroups_locked(cr, ngrp, groups);
diff --git a/sys/kern/subr_param.c b/sys/kern/subr_param.c
index 6113b63..fcd8131 100644
--- a/sys/kern/subr_param.c
+++ b/sys/kern/subr_param.c
@@ -40,6 +40,7 @@ __FBSDID("$FreeBSD$");
 #include "opt_param.h"
 #include "opt_maxusers.h"
 
+#include <sys/limits.h>
 #include <sys/param.h>
 #include <sys/systm.h>
 #include <sys/kernel.h>
@@ -88,6 +89,7 @@ int	maxfiles;			/* sys. wide open files limit */
 int	maxfilesperproc;		/* per-proc open files limit */
 int	ncallout;			/* maximum # of timer events */
 int	nbuf;
+int	ngroups_max;			/* max # groups per process */
 int	nswbuf;
 long	maxswzone;			/* max swmeta KVA storage */
 long	maxbcache;			/* max buffer cache KVA storage */
@@ -228,6 +230,18 @@ init_param1(void)
 	TUNABLE_ULONG_FETCH("kern.maxssiz", &maxssiz);
 	sgrowsiz = SGROWSIZ;
 	TUNABLE_ULONG_FETCH("kern.sgrowsiz", &sgrowsiz);
+
+	/*
+	 * Let the administrator set {NGROUPS_MAX}, but disallow values
+	 * less than NGROUPS_MAX which would violate POSIX.1-2008 or
+	 * greater than INT_MAX-1 which would result in overflow.
+	 */
+	ngroups_max = NGROUPS_MAX;
+	TUNABLE_INT_FETCH("kern.ngroups", &ngroups_max);
+	if (ngroups_max < NGROUPS_MAX)
+		ngroups_max = NGROUPS_MAX;
+	if (ngroups_max > INT_MAX - 1)
+		ngroups_max = INT_MAX - 1;
 }
 
 /*
diff --git a/sys/rpc/authunix_prot.c b/sys/rpc/authunix_prot.c
index fc03dff..b1b70a5 100644
--- a/sys/rpc/authunix_prot.c
+++ b/sys/rpc/authunix_prot.c
@@ -110,7 +110,7 @@ xdr_authunix_parms(XDR *xdrs, uint32_t *time, struct xucred *cred)
 	if (!xdr_uint32_t(xdrs, &ngroups))
 		return (FALSE);
 	for (i = 0; i < ngroups; i++) {
-		if (i + 1 < NGROUPS) {
+		if (i + 1 < ngroups_max + 1) {
 			if (!xdr_uint32_t(xdrs, &cred->cr_groups[i + 1]))
 				return (FALSE);
 		} else {
@@ -120,8 +120,8 @@ xdr_authunix_parms(XDR *xdrs, uint32_t *time, struct xucred *cred)
 	}
 
 	if (xdrs->x_op == XDR_DECODE) {
-		if (ngroups + 1 > NGROUPS)
-			cred->cr_ngroups = NGROUPS;
+		if (ngroups + 1 > ngroups_max + 1)
+			cred->cr_ngroups = ngroups_max + 1;
 		else
 			cred->cr_ngroups = ngroups + 1;
 	}
diff --git a/sys/security/audit/audit_arg.c b/sys/security/audit/audit_arg.c
index 6d99666..562b799 100644
--- a/sys/security/audit/audit_arg.c
+++ b/sys/security/audit/audit_arg.c
@@ -262,8 +262,8 @@ audit_arg_groupset(gid_t *gidset, u_int gidset_size)
 	u_int i;
 	struct kaudit_record *ar;
 
-	KASSERT(gidset_size <= NGROUPS,
-	    ("audit_arg_groupset: gidset_size > NGROUPS"));
+	KASSERT(gidset_size <= ngroups_max + 1,
+	    ("audit_arg_groupset: gidset_size > (kern.ngroups + 1)"));
 
 	ar = currecord();
 	if (ar == NULL)
diff --git a/sys/sys/systm.h b/sys/sys/systm.h
index 75e89ae..07d43d9 100644
--- a/sys/sys/systm.h
+++ b/sys/sys/systm.h
@@ -64,6 +64,7 @@ extern int boothowto;		/* reboot flags, from console subsystem */
 extern int bootverbose;		/* nonzero to print verbose messages */
 
 extern int maxusers;		/* system tune hint */
+extern int ngroups_max;		/* max # of supplemental groups */
 
 #ifdef	INVARIANTS		/* The option is always available */
 #define	KASSERT(exp,msg) do {						\