Skip to content

Drop privilege elevation

The slurmer app was designed with an "executor" part, meant to have elevated privileges to be able to do setuid, and launch tasks as another user. In practice, this is not very convenient to use (regarding file access management), and is basically a process that lets anyone (besides a light level of auth) execute arbitrary code on the cluster as any user.

After discussion with the HPC team, this is too big a security issue, and making this model safer seems both unreliable (if no active maintenance is put on the project) and quite complicated. So we can drop the procedure, and make the code simpler on that side:

  • no executorcli;
  • no User required in the API requests
Edited by Robin Champenois