Re: [HTCondor-users] How to tell Condor not to run jobs as nobody?

[Todd Tannenbaum <tannenba@xxxxxxxxxxx>]

Re all the below, I assume you are using Linux?

Also, what is it you are trying to achieve?  Do you want your jobs to a) 
run as the user who submitted them (common desire if there is a shared 
file system like NFS across all nodes and all job files live on the 
shared file system), or b) run as specific slot users?    If (a), is the 
/etc/passwd file synced across all your machines such that each machine 
has the same list of user logins with the same associated UIDs?  If (b), 
do your specified slot users exist in the /etc/passwd file of the system?

Are you starting the condor_master daemon as user root?  Below you say 
"master runs as adminFOO and slave has an admin user called adminBAR", I 
do not know what you mean by this.  HTCondor cannot run jobs as 
different users unless the condor_master is started as root.

regards,
Todd


On 3/4/2014 12:29 PM, J J wrote:
> Hi,
>
> I am using 7.9.2 on master and 8.0.3 on slave nodes. My requirement is
> simple; all computations are done internally, not publicly facing at all.
> We have zero security risk really, this is just a small cluster set up for
> in-house testing and we trust our staff.
>
> According to this [1] and [2],
>
> * if UID_DOMAIN on master and slaves don't match, job is run as nobody
> * if TRUST_UID_DOMAIN is TRUE, UID_DOMAIN check is skipped
> * if UID_DOMAIN is * on both nodes, that's effectively the same as
> TRUST_UID_DOMAIN
> * I can set a particular user for each slot by SLOT1_USER, SLOT2_USER.
>
>
> I tried all the above and the method in [1] on both master and slave's
> condor_config.local and I still run jobs as nobody.
>
> I can tell this by having a Python script
> #!/usr/bin/env python
> import getpass
> print(getpass.getuser())
>
> and the outcome is nobody.
>
> Using SLOTx_USER method, the job is disconnected from slaves and then put
> into idle forever.
>
> The master runs as adminFOO and slave has an admin user called adminBAR.
> Can someone point out where my mistake is? I tried all combinations of
> above.
>
> Thanks.
>
> [1]:
> http://research.cs.wisc.edu/htcondor/manual/v8.0/3_6Security.html#SECTION004613200000000000000
>
> [2]:
> https://access.redhat.com/site/documentation/en-US/Red_Hat_Enterprise_MRG/1.2/html/Grid_User_Guide/sect-Grid_User_Guide-Configuration_options-Shared_File_System_Configuration_File_Macros.html
>
>
>
> _______________________________________________
> HTCondor-users mailing list
> To unsubscribe, send a message to htcondor-users-request@xxxxxxxxxxx with a
> subject: Unsubscribe
> You can also unsubscribe by visiting
> https://lists.cs.wisc.edu/mailman/listinfo/htcondor-users
>
> The archives can be found at:
> https://lists.cs.wisc.edu/archive/htcondor-users/