How much should we work around buggy Solaris/OpenIndiana/Illumos > 16 groups bugs?

[Jeremy Allison]

On Mon, Jun 10, 2013 at 08:12:59PM +0200, Björn Jacke wrote:
> On 2013-06-10 at 10:32 -0700 Jeremy Allison sent off:
> > tl;dr. It's a harmless change as far as I can see. It makes
> > things universally better for Solaris OS's.
> > 
> > Why should we not do this ?
> 
> because other userspace programms most probably don't fix the kernel bug in
> userspace by sorting the groups and thus other processes might access data that
> should not be accessable. By adding the qsort workaround we actively support
> those systems not to get fixed and leave a known security hole (deny-ACEs being
> of users with > 16 groups possibly being unevaluated) open.

I'm sorry, but this is a real stretch.

If we can make this work without harm to Samba,
and Andrews' patch does just that, then we should
do so.

Saying things like:

"we actively support those systems
not to get fixed and leave a known security hole"

just makes us sound like completely sanctimonious
pricks. We're not in charge of security at Illumos,
we just need to make Samba work the best it can
for the most users.

Let's just fix this in our code and move on.

Jeremy.