Re: Number of ACL-Entries

I hesitated in responding because I was hoping that someone with some
similar admin experience would speak up.  I'll give it a shot anyway.

On Thu, 2006-07-27 at 10:03 +0200, S. Klaiber wrote:
> Hi Shaggy and Andreas,
> 
> thanks for your quick and valuable answers!
> I have a scenario with about 7000 users who are required to share files with
> each other and arrange individual access to those files. Division of these
> files in goups would be the best idea since they are expected to be
> classified by projects.
> 
> But what if there are more projects than the limit of group-assignments to a
> user?

I would think that if you have some class of users that you want to give
access to every project, you would create a group for them, rather than
adding them to every group.

Maybe a small project could add individual acl entries for users, and
maybe some privileged groups.  A project with a larger following may
create a project group and add lots of users to it.

> In HP/UX 11.11 the maximum number of groups in the system was 20. In Solaris
>  8 it was also 16 or 20. What is the maximum number of groups in 2.6 Linux?
>  And in how many groups can a user be listed? I assume that the value of
> NGROUPS_MAX in the kernel sources (include/linux/limits.h, v. 2.6.9-34)
> define the maximum number of groups in the system. This is currently 65536
> (/proc/sys/ngroups_max or sysctl -a). But what is the maximum number of
> groups that a user can be assigned to?

The kernel will allow a user to be a member of 65536 groups, but I'm not
sure if glibc and other important user-space programs allow it.

> Currently i am working on a concept where the files are stored in a database
> and the users can define each others access by setting up ACLs within the
> DBMs via a web-interface. I could also deny direct access to the files via
> the file system and write a special service that has an own ACL-Management
> and controls the file access. Just like ftp but with an own ACL handling. But
> fs ACLs would be the best idea.

I think it can be done well with acl's, but I don't have any personal
experience managing anything like this.

Anybody else on the list, feel free to speak up.  :-)
-- 
David Kleikamp
IBM Linux Technology Center

_______________________________________________
acl-devel mailing list
[email protected]
http://acl.bestbits.at/mailman/listinfo/acl-devel