Write wrapper script for policy run submission
Need a python script to wrap the submit-pol-job
command to make it easier to grant permissions for non-root to run select policy files.
Points of consideration:
- Don't want to make unnecessary changes to the
run-mmpol.sh
script to make it more difficult for Ops to run all varieties of policies. So input sanitation and restriction of which policies a person can run needs to come from the currentsubmit-pol-job
and the newrun-submit-pol-job.py
wrapper scripts instead.- Can make some edits to
run-mmpol.sh
to make ease of use better though like adding optional arguments with defaults and a help message - Strict input sanitization done in the Python wrapper
- Can make some edits to
Potential Security Vulnerabilities:
- The Python script must be read-only everywhere. Being able to alter the Python script means someone could alter the called path to the shell wrapper to their own version which could be written to do anything.
- Policy replacement. Anyone with write access to the policy files can change a
list-policy
to adelete-policy
.- This can be a subdirectory in the repository. All syncs that happen from remote to local regarding
./gpfs-policy/src/run-policy
must be done as root.
- This can be a subdirectory in the repository. All syncs that happen from remote to local regarding
Theoretical File Organization with Permissions:
└── gpfs-policy (drwxrwx--- root:atlab)/
└── src (drwxrwx--- root:atlab)/
└── run-policy (dr-xr-x--- root:atlab)/
├── out (drwxrws--- root:atlab)/
│ ├── slurm-12345678.out
│ └── ...
├── run-submit-pol-job.py (-r-xr-x--- root:atlab)
├── submit-pol-job (-r-xr----- root:atlab)
├── run-mmpol.sh (-r-xr----- root:atlab)
└── policy-def (dr-xr-x--- root:atlab)/
├── list-path-dirplus (-r-xr----- root:atlab)
└── list-path-external (-r-xr----- root:atlab)
Edited by Matthew K Defenderfer