macOS Mojave: setgroups(501) failed: Too many extra groups

[Heiko W. Rupp]

Hello,

I have recently upgraded to macOS 10.14 (Mojave) and am running into an 
issue where one use can no longer log into dovecot via imap. Log shows

Oct 11 08:10:27 imap(hwr)<12659><YpC/0+133+EAAAAAAAAAAAAAAAAAAAAB>: 
Fatal: setgroups(501) failed: Too many extra groups

and indeed, the user is in 17 groups, which is more than NGROUPS_MAX 
(16).
Another user with << 16 groups can log in fine. Unfortunately it is not 
(easily) doable to reduce
the number of groups, as macOS seems to set them internally.

Is there a config option that I am missing to work around this?

Looking at the source, I see this is handled in 
src/lib/restrict-access.c::fix_groups_list(),
where above the call to setgroups() a gid_list2 is constructed. I wonder 
if one could
have a config option to prevent adding all those extra groups, which 
then make the
call to setgroups() fail

Any help appreciated
    Heiko

-- 
hwr at pilhuhn.de  m:0179/207 4919  b:http://pilhuhn.blogspot.com