Repository navigation
rfc15: update and tighten description of IMP environment passed to the job shell and run targets - #560
Merged
Conversation
|
|
Contributor
|
Queued — the merge queue status continues in this comment ↓. |
Problem: The default set of environment variables passed through by `flux-imp run` is specified as FLUX_JOB_ID and FLUX_JOB_USERID, but the job manager also sets FLUX_JOB_RANKS in the environment of prolog, epilog, and housekeeping commands. Sites that want it must set allowed-environment, and the common advice to use a glob such as "FLUX_*" opens a hole, since every variable named there is supplied by the unprivileged instance owner and lands in the environment of a command running as root. Add FLUX_JOB_RANKS to the default set so that the defaults match what the job manager supplies and allowed-environment is not needed for the commands provided with Flux. State that the environment SHALL NOT be otherwise inherited, and that PATH is set by the IMP and SHALL NOT be overridden by this key. Add a note discouraging glob patterns. Assisted-by: Claude:opus-5
Problem: RFC 15 does not specify the environment the IMP passes to the job shell. The IMP is invoked by the instance owner and spawns the shell as a guest user, so its inherited environment is tainted input in the same sense as J, which the spec is otherwise careful about. Left unspecified, an implementation may pass the environment through unmodified, which allows the instance owner to set variables naming a search path for an executable or shared object, and so run arbitrary code as the guest user. Specify the environment inherited by the job shell in the spec. Include the motivations for the restrictions for reference. Assisted-by: Claude:opus-5
Problem: A job shell may need to know whether the enclosing instance is running as a different user than itself, but it has no trustworthy source for this. The spec does not describe any mechanism by which the IMP conveys this, and the preceding section restricts the job shell environment to a closed list that an IMP-supplied variable does not fit. Require the IMP to set FLUX_IMP_EXEC_USERID in the environment of the job shell to the user ID under which it was invoked, and add variables set by the IMP to the list of what the job shell environment may contain. Require that the IMP determine the value itself and set it unconditionally, so an inherited value cannot be mistaken for it. Assisted-by: Claude:opus-5
Contributor
Merge Queue Status
This pull request spent 13 seconds in the queue, including 1 second running CI. Required conditions to merge
|
|
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem: RFC 15 doesn't fully specify the environment passed to the job shell, which allows the implementation to pass the full environment to the job shell from an untrusted source. For the 'imp run' case, the environment is too minimal which encourages the use of globs in
allowed-environment, which results in arbitrary and unnecessary environment variables passed to processes running as root.Update and tighten the set of environment variables propagated via 'run' an 'exec' by the IMP:
FLUX_JOB_RANKSto the default set of environment variables passed byrun. This is the sole environment variable found by inspection that necessitatesFLUX_*inallowed-environment, so now use ofallowed-environmentcan be dropped in most cases and globbing discouraged.execso that only necessary environment variables are passed through the IMP to the job shell.FLUX_IMP_EXEC_USERIDto contain the userid that invoked the IMP. This will allow the job shell to securely determine when it is being run within an instance as a guest user, rather than trusting the instancesecurity.owner.