Re: [Condor-users] Running jobs as nobody on all machines

[Jaime Frey <jfrey@xxxxxxxxxxx>]

Have you considered using Condor's file transfer mechanism? It will  
transfer the files from the execute machine to the submit machine.  
That way, it doesn't matter what user the job is running under on the  
execute machine.

Another option is to add a requirement to the job that it not run on  
the machine it was submitted to.

 -- Jaime

On Dec 5, 2005, at 10:04 PM, Emir Imamagic wrote:

> Hi,
>
> we have a rather specific application which generates large
> amount of permanent files in a specific directory on a machine  
> where it
> gets executed. Since the execute machine can in the same time be  
> submit
> machine, files are generated with ownerhip of actual user. In the  
> worse
> case scenario job fails because of lack of write permission on  
> directory.
>
> First we solved this by setting changing group ownership and  
> setting group
> write permission manually. However, this is not really an elegant
> solution, because we have to do it on all machines whenever we use new
> specific directory.
>
> Anyway, now, we're changing the application to setuid to nobody  
> itself.
>
> Still I would like to know how can I achieve this in a Condor
> configuration (if it's possible).
>
> Thanks,
> emir
>
> On Mon, 5 Dec 2005, Jaime Frey wrote:
>
> > Is there some reason why you can't have UID_DOMAIN = FULL_HOSTNAME?
> >
> >  -- Jaime
> >
> > On Dec 5, 2005, at 6:51 AM, Emir Imamagic wrote:
> >
> > > I found following explanation in documentation:
> > > (http://www.cs.wisc.edu/condor/manual/v6.7/3_3Configuration.html)
> > > -------------------------------------------------------------------- 
> > > --
> > > -----
> > > You can also leave $(UID_DOMAIN) undefined. This will force  
> > > Condor to
> > > always run jobs as user nobody. Running standard universe jobs as  
> > > user
> > > nobody enhances your security and should cause no problems, because
> > > the
> > > jobs use remote I/O to access all of their files. ...
> > > -------------------------------------------------------------------- 
> > > --
> > > -----
> > >
> > > However, when I leave UID_DOMAIN undefined in config files, Condor
> > > sets
> > > it to FULL_HOSTNAME.
> > >
> > > Cheers,
> > > emir
> > >
> > >
> > > Emir Imamagic wrote:
> > > > Hello to all,
> > > >
> > > > is there a way to force Condor to run jobs as user nobody even in
> > > > case
> > > > when UID_DOMAIN is same on submit and remote machine?
> > > >
> > > > Thanks in advance,
> > > > emir
> > > > _______________________________________________
> > > > Condor-users mailing list
> > > > Condor-users@xxxxxxxxxxx
> > > > https://lists.cs.wisc.edu/mailman/listinfo/condor-users
> > >
> > > _______________________________________________
> > > Condor-users mailing list
> > > Condor-users@xxxxxxxxxxx
> > > https://lists.cs.wisc.edu/mailman/listinfo/condor-users
> >
> > +---------------------------------- 
> > +---------------------------------+
> > |            Jaime Frey            |  Public Split on  
> > Whether        |
> > |        jfrey@xxxxxxxxxxx         |  Bush Is a  
> > Divider              |
> > |  http://www.cs.wisc.edu/~jfrey/  |         -- CNN Scrolling  
> > Banner |
> > +---------------------------------- 
> > +---------------------------------+
> >
> >
> > _______________________________________________
> > Condor-users mailing list
> > Condor-users@xxxxxxxxxxx
> > https://lists.cs.wisc.edu/mailman/listinfo/condor-users
> _______________________________________________
> Condor-users mailing list
> Condor-users@xxxxxxxxxxx
> https://lists.cs.wisc.edu/mailman/listinfo/condor-users

+----------------------------------+---------------------------------+
|            Jaime Frey            |  Public Split on Whether        |
|        jfrey@xxxxxxxxxxx         |  Bush Is a Divider              |
|  http://www.cs.wisc.edu/~jfrey/  |         -- CNN Scrolling Banner |
+----------------------------------+---------------------------------+