Skip to content

Conversation

@mattmix
Copy link

@mattmix mattmix commented Dec 3, 2018

When users are not members of their primary group[1], initgroups(3) being called with the group listed in the group_list parameter causes the primary group to be missing in supplemental group list for the launched job.

This change will cause init_groups to always call initgroups(3) with the user's primary group so that it will continue to exist later on when setgid is called with the group from the group_list.

Redacted example:

[user@login ~] # groups
primarygrp secondarygrp

# Unpatched node:
[user@login ~] # qsub -I -W group_list=secondarygrp
[user@compute ~] groups
secondarygrp

# Patched node:
[user@login ~] # qsub -I -W group_list=secondarygrp
[user@compute ~] groups
secondarygrp primarygrp

[1] Happens when the user's entry in LDAP assigns them to a group, but they aren't added to the group member list.

When users are not members of their primary group[1], initgroups(3) being called with the group listed in the group_list parameter causes the primary group to be missing in supplemental group list for the launched job. 

This change will cause init_groups to always call initgroups(3) with the user's primary group so that it will continue to exist later on when setgid is called with the group from the group_list. 

Redacted example:
```
[user@login ~] # groups
primarygrp secondarygrp

# Unpatched node:
[user@login ~] # qsub -I -W group_list=secondarygrp
[user@compute ~] groups
secondarygrp

# Patched node:
[user@login ~] # qsub -I -W group_list=secondarygrp
[user@compute ~] groups
secondarygrp primarygrp
```

[1] Happens when the user's entry in LDAP assigns them to a group, but they aren't added to the group member list.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant