From f7f253a9a5257dda7dafdb07b7bb89e301d0fa39 Mon Sep 17 00:00:00 2001 From: Philip Kovacs Date: Oct 05 2017 18:22:05 +0000 Subject: Patch changes per resolution of upstream bug #4101: salloc/sbatch/srun: must be root to use --uid/--gid options. salloc: supplemental groups dropped after setuid. --- diff --git a/slurm.spec b/slurm.spec index 2613026..58da823 100644 --- a/slurm.spec +++ b/slurm.spec @@ -26,7 +26,7 @@ Name: slurm Version: 17.02.7 -Release: 3%{?dist} +Release: 4%{?dist} Summary: Simple Linux Utility for Resource Management License: GPLv2 and BSD URL: https://slurm.schedmd.com/ @@ -38,16 +38,17 @@ Source4: slurm-128x128.png Source5: slurm_setuser.in # upstream bugs #4094, #4095, #4101, #4113 -Patch0: slurm_salloc_privileges.patch -Patch1: slurm_format_truncation.patch +Patch0: slurm_opts_restrict.patch +Patch1: slurm_salloc_setgroups.patch +Patch2: slurm_format_truncation.patch # build-related patches -Patch2: slurm_perlapi_rpaths.patch -Patch3: slurm_html_doc_path.patch -Patch4: slurm_doc_fix.patch +Patch3: slurm_perlapi_rpaths.patch +Patch4: slurm_html_doc_path.patch +Patch5: slurm_doc_fix.patch # Fedora-related patches -Patch5: slurm_service_files.patch +Patch6: slurm_service_files.patch BuildRequires: pkgconfig(gtk+-2.0) BuildRequires: hdf5-devel @@ -219,6 +220,7 @@ Torque wrapper scripts used for helping migrate from Torque/PBS to Slurm. %patch3 -p1 %patch4 -p1 %patch5 -p1 +%patch6 -p1 cp %SOURCE1 etc/slurm.conf cp %SOURCE1 etc/slurm.conf.example cp %SOURCE2 etc/slurmdbd.conf @@ -747,6 +749,11 @@ fi %systemd_postun_with_restart slurmdbd.service %changelog +* Thu Oct 5 2017 Philip Kovacs - 17.02.7-4 +- Patch changes per resolution of upstream bug #4101: +- salloc/sbatch/srun: must be root to use --uid/--gid options. +- salloc: supplemental groups dropped after setuid. + * Thu Oct 5 2017 Philip Kovacs - 17.02.7-3 - Added BuildRequires gcc and minor packaging conformance items. diff --git a/slurm_opts_restrict.patch b/slurm_opts_restrict.patch new file mode 100644 index 0000000..ddf6bed --- /dev/null +++ b/slurm_opts_restrict.patch @@ -0,0 +1,72 @@ +--- slurm-17.02.7/src/salloc/opt.c.old 2017-10-05 13:33:36.300529834 -0400 ++++ slurm-17.02.7/src/salloc/opt.c 2017-10-05 13:37:02.093162798 -0400 +@@ -1054,6 +1054,10 @@ + } + break; + case LONG_OPT_UID: ++ if (getuid() != 0) { ++ error("--uid only permitted by root user"); ++ exit(error_exit); ++ } + if (opt.euid != (uid_t) -1) { + error("duplicate --uid option"); + exit(error_exit); +@@ -1064,6 +1068,10 @@ + } + break; + case LONG_OPT_GID: ++ if (getuid() != 0) { ++ error("--gid only permitted by root user"); ++ exit(error_exit); ++ } + if (opt.egid != (gid_t) -1) { + error("duplicate --gid option"); + exit(error_exit); +--- slurm-17.02.7/src/sbatch/opt.c.old 2017-10-05 13:39:04.067419821 -0400 ++++ slurm-17.02.7/src/sbatch/opt.c 2017-10-05 13:41:20.388042002 -0400 +@@ -1621,6 +1621,10 @@ + opt.jobid_set = true; + break; + case LONG_OPT_UID: ++ if (getuid() != 0) { ++ error("--uid only permitted by root user"); ++ exit(error_exit); ++ } + if (opt.euid != (uid_t) -1) { + error("duplicate --uid option"); + exit(error_exit); +@@ -1631,6 +1635,10 @@ + } + break; + case LONG_OPT_GID: ++ if (getuid() != 0) { ++ error("--gid only permitted by root user"); ++ exit(error_exit); ++ } + if (opt.egid != (gid_t) -1) { + error("duplicate --gid option"); + exit(error_exit); +--- slurm-17.02.7/src/srun/libsrun/opt.c.old 2017-10-05 13:42:57.195643601 -0400 ++++ slurm-17.02.7/src/srun/libsrun/opt.c 2017-10-05 13:44:34.753262251 -0400 +@@ -1450,6 +1450,10 @@ + _get_int(optarg, "max-exit-timeout", true); + break; + case LONG_OPT_UID: ++ if (getuid() != 0) { ++ error("--uid only permitted by root user"); ++ exit(error_exit); ++ } + if (opt.euid != (uid_t) -1) { + error("duplicate --uid option"); + exit(error_exit); +@@ -1460,6 +1464,10 @@ + } + break; + case LONG_OPT_GID: ++ if (getuid() != 0) { ++ error("--gid only permitted by root user"); ++ exit(error_exit); ++ } + if (opt.egid != (gid_t) -1) { + error("duplicate --gid option"); + exit(error_exit); diff --git a/slurm_salloc_privileges.patch b/slurm_salloc_privileges.patch deleted file mode 100644 index 3cc2910..0000000 --- a/slurm_salloc_privileges.patch +++ /dev/null @@ -1,53 +0,0 @@ ---- slurm-17.02.7/src/salloc/salloc.c 2017-08-14 13:48:43.000000000 -0400 -+++ slurm-17.02.7/src/salloc/salloc.c.new 2017-08-23 00:07:22.759099425 -0400 -@@ -42,6 +42,7 @@ - - #include - #include -+#include - #include - #include - #include -@@ -298,13 +299,27 @@ - if (_fill_job_desc_from_opts(&desc) == -1) { - exit(error_exit); - } -- if (opt.gid != (gid_t) -1) { -+ -+ /* If the requested gid is different than ours, become that gid */ -+ if ((getgid() != opt.gid) && (opt.gid != (gid_t) -1)) { - if (setgid(opt.gid) < 0) { - error("setgid: %m"); - exit(error_exit); - } - } - -+ /* If the requested uid is different than ours, become that uid */ -+ if ((getuid() != opt.uid) && (opt.uid != (uid_t) -1)) { -+ if (setgroups(0, NULL) < 0) { -+ error("setgroups: %m"); -+ exit(error_exit); -+ } -+ if (setuid(opt.uid) < 0) { -+ error("setuid: %m"); -+ exit(error_exit); -+ } -+ } -+ - callbacks.ping = _ping_handler; - callbacks.timeout = _timeout_handler; - callbacks.job_complete = _job_complete_handler; -@@ -333,13 +348,6 @@ - sleep (++retries); - } - -- /* become the user after the allocation has been requested. */ -- if (opt.uid != (uid_t) -1) { -- if (setuid(opt.uid) < 0) { -- error("setuid: %m"); -- exit(error_exit); -- } -- } - if (alloc == NULL) { - if (allocation_interrupted) { - /* cancelled by signal */ diff --git a/slurm_salloc_setgroups.patch b/slurm_salloc_setgroups.patch new file mode 100644 index 0000000..efb9260 --- /dev/null +++ b/slurm_salloc_setgroups.patch @@ -0,0 +1,18 @@ +--- slurm-17.02.7/src/salloc/salloc.c.old 2017-10-05 13:25:52.403682572 -0400 ++++ slurm-17.02.7/src/salloc/salloc.c 2017-10-05 13:29:52.913975815 -0400 +@@ -333,8 +333,13 @@ + sleep (++retries); + } + +- /* become the user after the allocation has been requested. */ +- if (opt.uid != (uid_t) -1) { ++ /* If the requested uid is different than ours, become that uid */ ++ if ((getuid() != opt.uid) && (opt.uid != (uid_t) -1)) { ++ /* drop extended groups before changing uid/gid */ ++ if ((setgroups(0, NULL) < 0)) { ++ error("setgroups: %m"); ++ exit(error_exit); ++ } + if (setuid(opt.uid) < 0) { + error("setuid: %m"); + exit(error_exit);