Re: [Condor-users] Condor and processor affinity

[Matt Hope <Matt.Hope@xxxxxxxxxxxxxxx>]

> I this a security hole in that it might be possible for the child process
> to spawn a child process of its own in the time window between the call to
> CreateProcess() and AssignProcessToJobObject()?  If so, then I don't think
> this affects us, since we start all user processes in a suspended state,
> so that we can do a few things of our own, after-which we start the
> process.  In our case, there is, effectively, no windows between the call
> to CreateProcess() and the one to AssignProcessToJobObject().

If this is secure (I'm no security expert, especially not on Win32) then that's fine. I actually don't care either way since our farm is run assuming non malicious users.

> My thought, and please correct me if this is a bad approach, was that the
> starter would "own" the job object (i.e. keep a copy of it) and only add
> the Condor Job's process as a member, and not the starter itself.  This
> way the starter could continue to track the Condor job using an extension
> to the existing processes tracking framework (i.e. the condor_procd).

I believe this should work fine, it is possible to own/interact with a job without making yourself part of it.

> Would you find having all the Windows Job Object options exposed to be
> helpful, or is there a specific subset that, in your experience, has been
> used the most.  It seems to me that exposing the quota options would be
> helpful, but I'm uncertain about the UI restrictions, for instance.

Currently we only limit memory and cpu affinity. Anything else is not important to our needs though I imagine limiting UI access would be something some people would like...

You would likely want to default to prevent CREATE_BREAKAWAY_FROM_JOB as well

Hope that helps

Matt

----
Gloucester Research Limited believes the information provided herein is reliable. While every care has been taken to ensure accuracy, the information is furnished to the recipients with no warranty as to the completeness and accuracy of its contents and on condition that any errors or omissions shall not be made the basis for any claim, demand or cause for action.
The information in this email is intended only for the named recipient.  If you are not the intended recipient please notify us immediately and do not copy, distribute or take action based on this e-mail.
All messages sent to and from this email address will be logged by Gloucester Research Ltd and are subject to archival storage, monitoring, review and disclosure.
Gloucester Research Limited, 5th Floor, Whittington House, 19-30 Alfred Place, London WC1E 7EA.
Gloucester Research Limited is a company registered in England and Wales with company number 04267560.
----