Update RockyLinux 8.10 inc. OpenHPC v2.10, disable act_pedit (#994)

* Update RL8 timestamps to fix CVE-2026-46331

Not updating RL98 because the 5.14.0-687.17.1.el9_8 kernel
breaks DOCA OFED (change interface of dpll_pin_ops.ffo_get
in commit 9c11fcb of linux)

Not updating OHPC timestamps: OHPC 2.10 has an upgraded Slurm 25.11
which is too much of an upgrade to carry for this PR.

* Mitigate CVE-2026-46331 (pedit-COW)

* Rebuilt image

* update RL8 timestamps again

* bump CI image

* DEBUG: slurm backup

* fix slurmdb upgrade

* update grype GO vuln aliases again

* remove debug changes

* remove unneeded openhpc overrides after openhpc upgrade

* bump CI image

* change more grype aliases

* bump stackhpc.openhpc to release

* fix grype aliases, again

* remove unused grype ignores

---------

Co-authored-by: Steve Brasier <steveb@stackhpc.com>

Author: elelaysh

.grype.yaml

@@ -77,3 +77,23 @@
         cmd: rmmod ip6_tunnel
       failed_when: false
       changed_when: true
+
+- name: Apply pedit COW (CVE-2026-46331) mitigation
+  hosts: mitigate_cve_2026_46331
+  gather_facts: false
+  become: true
+  tasks:
+    - name: Prevent modules loading
+      ansible.builtin.copy:
+        dest: /etc/modprobe.d/cve_2026_46331.conf
+        owner: root
+        group: root
+        mode: u=rw,go=r
+        content: |
+          install act_pedit /bin/false
+    # below probably is not needed but is safer
+    - name: Unload modules
+      ansible.builtin.command:
+        cmd: rmmod act_pedit
+      failed_when: false
+      changed_when: true

ansible/mitigations.yml

@@ -84,10 +84,6 @@
     - ansible.builtin.include_role:
         name: stackhpc.openhpc
         tasks_from: "{{ 'runtime.yml' if appliances_mode == 'configure' else 'main.yml' }}"
-      vars:
-        # We used python3.9 to install a recent pymysql version, with fixed SQL injection vulnerability
-        # It is needed in the stackhpc.openhpc/tasks/upgrade.yml
-        ansible_python_interpreter: /usr/bin/python3.9
 
     - name: Flush handler
       ansible.builtin.meta: flush_handlers # get fresh ansible_local.slurm facts

ansible/slurm.yml

@@ -1,6 +1,6 @@
 {
   "cluster_image": {
-    "RL8": "openhpc-RL8-260701-1309-c96fa636",
-    "RL9": "openhpc-RL9-260701-1309-c96fa636"
+    "RL8": "openhpc-RL8-260709-1110-095e2432",
+    "RL9": "openhpc-RL9-260709-1110-095e2432"
   }
 }

environments/.stackhpc/tofu/cluster_image.auto.tfvars.json

@@ -20,7 +20,7 @@ dnf_repos_default:
   OpenHPC-updates:
     '8':
       pulp_path: OpenHPC/2/updates/EL_8
-      pulp_timestamp: 20250512T003315
+      pulp_timestamp: 20260622T230143
       repo_file: OpenHPC
     '9':
       pulp_path: OpenHPC/3/updates/EL_9
@@ -47,7 +47,7 @@ dnf_repos_default:
   appstream:
     '8.10':
       pulp_path: rocky/8.10/AppStream/x86_64/os
-      pulp_timestamp: 20260605T221539
+      pulp_timestamp: 20260706T220507
       repo_file: Rocky-AppStream
     '9.4':
       pulp_path: rocky/9.4/AppStream/x86_64/os
@@ -72,7 +72,7 @@ dnf_repos_default:
   appstream-source:
     '8.10':
       pulp_path: rocky/8.10/AppStream/source/tree
-      pulp_timestamp: 20260606T213518
+      pulp_timestamp: 20260706T214107
       repo_file: Rocky-Sources
     '9.6':
       pulp_path: rocky/9.6/AppStream/source/tree
@@ -89,7 +89,7 @@ dnf_repos_default:
   baseos:
     '8.10':
       pulp_path: rocky/8.10/BaseOS/x86_64/os
-      pulp_timestamp: 20260605T221539
+      pulp_timestamp: 20260706T220507
       repo_file: Rocky-BaseOS
     '9.4':
       pulp_path: rocky/9.4/BaseOS/x86_64/os
@@ -114,7 +114,7 @@ dnf_repos_default:
   baseos-source:
     '8.10':
       pulp_path: rocky/8.10/BaseOS/source/tree
-      pulp_timestamp: 20260606T213518
+      pulp_timestamp: 20260706T214107
       repo_file: Rocky-Sources
     '9.6':
       pulp_path: rocky/9.6/BaseOS/source/tree
@@ -140,7 +140,7 @@ dnf_repos_default:
   cernvmfs_eessi_cfg:
     '8':
       pulp_path: eessi/rhel/8/noarch
-      pulp_timestamp: 20251119T202303
+      pulp_timestamp: 20260616T214234
       repo_file: cvmfs-config-eessi
     '9':
       pulp_path: eessi/rhel/8/noarch
@@ -158,7 +158,7 @@ dnf_repos_default:
   crb:
     '8.10':
       pulp_path: rocky/8.10/PowerTools/x86_64/os
-      pulp_timestamp: 20260531T214327
+      pulp_timestamp: 20260706T220507
       repo_file: Rocky-PowerTools
       repo_name: powertools
     '9.4':
@@ -202,7 +202,7 @@ dnf_repos_default:
   epel:
     '8':
       pulp_path: epel/8/Everything/x86_64
-      pulp_timestamp: 20260610T221908
+      pulp_timestamp: 20260706T214454
       repo_file: epel
     '9':
       pulp_path: epel/9/Everything/x86_64
@@ -216,7 +216,7 @@ dnf_repos_default:
   epel-source:
     '8':
       pulp_path: epel/8/Everything/source/tree
-      pulp_timestamp: 20260610T221908
+      pulp_timestamp: 20260706T214454
       repo_file: epel
     '9':
       pulp_path: epel/9/Everything/source/tree
@@ -250,7 +250,7 @@ dnf_repos_default:
   extras-source:
     '8.10':
       pulp_path: rocky/8.10/extras/source/tree
-      pulp_timestamp: 20260506T212931
+      pulp_timestamp: 20260625T224657
       repo_file: Rocky-Sources
     '9.6':
       pulp_path: rocky/9.6/extras/source/os
@@ -267,7 +267,7 @@ dnf_repos_default:
   grafana:
     '8':
       pulp_path: grafana/oss/rpm
-      pulp_timestamp: 20260610T211431
+      pulp_timestamp: 20260701T070549
       repo_file: grafana
     '9':
       pulp_path: grafana/oss/rpm

environments/common/inventory/group_vars/all/dnf_repo_timestamps.yml

@@ -53,10 +53,7 @@ openhpc_state_save_location: "{{ appliances_state_dir + '/slurmctld' if applianc
 openhpc_config_extra: {}
 
 # additional default slurm.conf parameters for the appliance:
-openhpc_config_default:
-  TaskPlugin: task/cgroup,task/affinity
-  ProctrackType: proctrack/cgroup
-  JobAcctGatherType: jobacct_gather/cgroup
+openhpc_config_default: {}
 
 # additional default slurm.conf parameters when "rebuild" enabled:
 openhpc_config_rebuild:

environments/common/inventory/group_vars/all/openhpc.yml

@@ -241,3 +241,4 @@ doca
 [mitigate_dirtyfrag]
 [mitigate_ssh_keysign_pwn]
 [mitigate_cve_2026_43037]
+[mitigate_cve_2026_46331]

environments/common/inventory/groups

@@ -224,3 +224,5 @@ builder
 builder
 [mitigate_cve_2026_43037:children]
 builder
+[mitigate_cve_2026_46331:children]
+builder

environments/site/inventory/groups

@@ -4,7 +4,7 @@ roles:
     version: v26.2.1
     name: stackhpc.nfs
   - src: https://github.com/stackhpc/ansible-role-openhpc.git
-    version: v1.5.0
+    version: v1.6.0
     name: stackhpc.openhpc
   - src: https://github.com/stackhpc/ansible-grafana.git
     name: cloudalchemy.grafana