bsd/kern/kern_credential.c

196 #define	KAUTH_CACHES_MAX_SIZE 10000 /* Max # entries for both groups and id caches */
348  *		This is how membership in more than 16 groups (1 effective
1152 				panic("can't allocate kauth identity with both gid and supplementary groups");
1556  *						groups expiration
1874  *		groups already, then rotate the old EGID into its position,
1883  *					of the supplementary groups list
1929 	 * If we displaced a member of the supplementary groups list of the
2070  * Structure to hold supplemental groups. Used for impedance matching with
2075 	gid_t *groups;
2084  *		groups				pointer to an array of gid_ts
2085  *		gcount				pointer to the number of groups wanted/returned
2091  *		*groups				Modified, if successful
2096 kauth_cred_uid2groups(uid_t *uid, gid_t *groups, int *gcount)
2102 	supgroups.groups = groups;
2682 			 * Copy the current supplemental groups for the resolver.
2683 			 * The resolver should check these groups first and if
2692 			/* Let the resolver know these were the previous valid groups */
2696 			KAUTH_DEBUG("GROUPS: no valid groups to send");
2763 			memcpy(gp->groups, ki.ki_supgrps, sizeof(gid_t) * limit);
2787  * Description:	Initialize the groups cache
2793  * Notes:	Initialize the groups cache for use; the group cache is used
2976  *		of one of the supplementary groups associated with the given
3010 	 * Check the per-credential list of override groups.
3046 	/* XXX check supplementary groups */
3047 	/* XXX check whiteout groups */
3048 	/* XXX nesting of supplementary/whiteout groups? */
3233 	/* First, check the local list of groups */
3971  * Update the given credential with the given groups.  We only allocate a new
3984  *		groups				Pointer to gid_t array which
3986  *		groupcount			The count of valid groups which
3987  *						are contained in 'groups'
4010  *		in the same groups list that is already present in the
4020 kauth_cred_setgroups(kauth_cred_t cred, gid_t *groups, int groupcount, uid_t gmuid)
4032 	 * We don't need to do anything if the given list of groups does not
4037 			if (pcred->cr_groups[i] != groups[i])
4055 	bcopy(groups, temp_pcred->cr_groups, sizeof(temp_pcred->cr_groups));
4087 	 * of supplemental groups. We do this only if there has been a resolver to talk to,
4104 	 * If they just want a copy of the groups list, they may not care
5459 	short	cr_ngroups;			/* number of groups in advisory list */