I finally had a chance to experiment with this some.

I think one basic problem was that I had bash as a login shell. Removing bash 
from the login shell and specifying "qsub -S /bin/bash ...." passed my local 
PATH to the remote job.

But when I don't specify "-S /bin/bash" I get the csh login PATH settings. 
That's our default shell for the queue I'm using. 

This happens even when csh isn't in the login shell list. I find that 
unexpected.

Adam

-----Original Message-----
From: users-boun...@gridengine.org [mailto:users-boun...@gridengine.org] On 
Behalf Of Hay, William
Sent: Wednesday, January 22, 2020 9:55 AM
To: Skylar Thompson <skyl...@uw.edu>
Cc: users@gridengine.org
Subject: Re: [gridengine users] qsub -V doesn't set $PATH

On Tue, Jan 21, 2020 at 03:51:01PM +0000, Skylar Thompson wrote:
> -V strips out PATH and LD_LIBRARY_PATH for security reasons, since 
> prolog

I don't think this is the case.  I've just experimented with one of our 8.1.9 
clusters and I can set arbitrary PATHs run qsub -V and have the value I set 
show up in the environment of the job.  More likely the job is being run with a 
shell that is configured as a login shell and the init scripts for the shell 
are stomping on the value of PATH.

> and epilog scripts run with the submission environment but possibly in 
> the context of a different user (i.e. a user could point a 
> root-running prolog script at compromised binaries or C library).

This is something slightly different. The prolog and epilog used to run with 
the exact same environment as the job.  This opened up an attack vector , 
especially if the prolog or epilog were run as a privileged user rather than 
the job owner.  The environment in which the prolog and eiplog are run is now 
sanitised.

William

_______________________________________________
users mailing list
users@gridengine.org
https://gridengine.org/mailman/listinfo/users

Reply via email to