Write wrapper script for policy run submission
Need a python script to wrap the submit-pol-job command to make it easier to grant permissions for non-root to run select policy files.
Points of consideration:
- Don't want to make unnecessary changes to the
run-mmpol.shscript to make it more difficult for Ops to run all varieties of policies. So input sanitation and restriction of which policies a person can run needs to come from the currentsubmit-pol-joband the newrun-submit-pol-job.pywrapper scripts instead.- Can make some edits to
run-mmpol.shto make ease of use better though like adding optional arguments with defaults and a help message - Strict input sanitization done in the Python wrapper
- Can make some edits to
Potential Security Vulnerabilities:
- The Python script must be read-only everywhere. Being able to alter the Python script means someone could alter the called path to the shell wrapper to their own version which could be written to do anything.
- Policy replacement. Anyone with write access to the policy files can change a
list-policyto adelete-policy.- This can be a subdirectory in the repository. All syncs that happen from remote to local regarding
./gpfs-policy/src/run-policymust be done as root.
- This can be a subdirectory in the repository. All syncs that happen from remote to local regarding
Theoretical File Organization with Permissions:
└── gpfs-policy (drwxrwx--- root:atlab)/
└── src (drwxrwx--- root:atlab)/
└── run-policy (dr-xr-x--- root:atlab)/
├── out (drwxrws--- root:atlab)/
│ ├── slurm-12345678.out
│ └── ...
├── run-submit-pol-job.py (-r-xr-x--- root:atlab)
├── submit-pol-job (-r-xr----- root:atlab)
├── run-mmpol.sh (-r-xr----- root:atlab)
└── policy-def (dr-xr-x--- root:atlab)/
├── list-path-dirplus (-r-xr----- root:atlab)
└── list-path-external (-r-xr----- root:atlab)
Edited by Matthew K Defenderfer