Write wrapper script for policy run submission

Need a python script to wrap the submit-pol-job command to make it easier to grant permissions for non-root to run select policy files.

Points of consideration:

  • Don't want to make unnecessary changes to the run-mmpol.sh script to make it more difficult for Ops to run all varieties of policies. So input sanitation and restriction of which policies a person can run needs to come from the current submit-pol-job and the new run-submit-pol-job.py wrapper scripts instead.
    • Can make some edits to run-mmpol.sh to make ease of use better though like adding optional arguments with defaults and a help message
    • Strict input sanitization done in the Python wrapper

Potential Security Vulnerabilities:

  • The Python script must be read-only everywhere. Being able to alter the Python script means someone could alter the called path to the shell wrapper to their own version which could be written to do anything.
  • Policy replacement. Anyone with write access to the policy files can change a list-policy to a delete-policy.
    • This can be a subdirectory in the repository. All syncs that happen from remote to local regarding ./gpfs-policy/src/run-policy must be done as root.

Theoretical File Organization with Permissions:

└── gpfs-policy (drwxrwx--- root:atlab)/
    └── src (drwxrwx--- root:atlab)/
        └── run-policy (dr-xr-x--- root:atlab)/
            ├── out (drwxrws--- root:atlab)/
            │   ├── slurm-12345678.out
            │   └── ...
            ├── run-submit-pol-job.py (-r-xr-x--- root:atlab)
            ├── submit-pol-job (-r-xr----- root:atlab)
            ├── run-mmpol.sh (-r-xr----- root:atlab)
            └── policy-def (dr-xr-x--- root:atlab)/
                ├── list-path-dirplus (-r-xr----- root:atlab)
                └── list-path-external (-r-xr----- root:atlab)
Edited Sep 04, 2024 by Matthew K Defenderfer
Assignee Loading
Time tracking Loading