18

We've recently run into a situation at a group-happy site where some group memberships are not being picked up. I seem to remember that there is an upper limit to the number of groups that a user can be a member of.

While I am specifically interested in modern Linux systems, I also remember that for some older versions of some OSs that number is lower?

6 Answers 6

20

The specific answer seems to be:

...which explains our problem, we've recently crossed the 16-group boundary for some users.

4
  • 1
    Interesting, wasn't aware of that limitation. Aug 21, 2009 at 3:22
  • 1
    The 16 groups per user limit is part of the sunRPC mechanism used for NFS (<4?). See RFC1057 "9.2 UNIX Authentication"
    – ikrabbe
    Jun 2, 2016 at 5:45
  • 2
    link to nfs group limit is broken
    – Tagar
    Sep 26, 2016 at 15:55
  • While this answer was correct when written, it's not quite true for any modern kernel. It's been 64 for over a decade now.
    – KalEl
    Aug 1, 2022 at 3:54
10

For Linux Kernel 2.6.3 and above the limit is 64k groups per user.

If you are using NFSv4 the limit is higher than 16, too. (not sure about exact numbers here)

4

Look for NGROUPS_MAX in limits.h to find the value on your system.

I think this is a tunable parameter in a modern Linux kernel. (Used to be 16 on Solaris, I don't know if they have fixed that yet.)

2
  • Just checked a Solaris 11 server, not it is not fixed there - still 16 :-(
    – Tagar
    Sep 27, 2016 at 18:04
  • 2
    You can also use getconf NGROUPS_MAX to receive this value from a shell.
    – MaPePeR
    Oct 31, 2018 at 7:47
2

You can overcome the 16 group limit for NFS on RHEL/CentOS/Fedora by updating the following setting in /etc/sysconfig/nfs:

RPCMOUNTDOPTS="--manage-gids"
0

According to this: sysconf(3)

#include <stdio.h>
#include <unistd.h>

int main(int argc, char** argv) {
    long max_group = 0;
    max_group = sysconf(_SC_NGROUPS_MAX);
    printf("Max group : %ld\n", max_group);
    return 0;
}

in the shell :

gcc -Wall -pedantic-errors -o maxgroup maxgroup.c
2
  • Can you explain why someone needs to compile a C program to get these values? Jul 8, 2020 at 0:18
  • Because it's system-specific and subject to change?
    – Mikel
    Sep 21, 2020 at 21:11
-2

See Above . You can get from sysconf the number of groups. You can use simple python one-line to get the value.

python -c 'import os; print(hex(os.sysconf("SC_NGROUPS_MAX")))'
3
  • 1
    A bit more detail would improve the answer
    – Dave M
    Jul 14, 2021 at 14:58
  • All the other data is written above, just gave a way to do the same without compile :) Jul 15, 2021 at 19:01
  • All answers must be complete. This is not a forum. Any given answer could be deleted and so each answer must be complete in and of itself, otherwise it belongs as a comment. Jul 17, 2021 at 3:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .