forked from pool/slurm
Egbert Eich
e7275730c8
- Update to 23.11.1 with following major improvements and fixing
CVE-2023-49933, CVE-2023-49934, CVE-2023-49935, CVE-2023-49936 and
CVE-2023-49937
* Substantially overhauled the SlurmDBD association management code. For
clusters updated to 23.11, account and user additions or removals are
significantly faster than in prior releases.
* Overhauled 'scontrol reconfigure' to prevent configuration mistakes from
disabling slurmctld and slurmd. Instead, an error will be returned, and the
running configuration will persist. This does require updates to the
systemd service files to use the --systemd option to slurmctld and slurmd.
* Added a new internal auth/cred plugin - "auth/slurm". This builds off the
prior auth/jwt model, and permits operation of the slurmdbd and slurmctld
without access to full directory information with a suitable configuration.
* Added a new --external-launcher option to srun, which is automatically set
by common MPI launcher implementations and ensures processes using those
non-srun launchers have full access to all resources allocated on each
node.
* Reworked the dynamic/cloud modes of operation to allow for "fanout" - where
Slurm communication can be automatically offloaded to compute nodes for
increased cluster scalability.
Added initial official Debian packaging support.
* Overhauled and extended the Reservation subsystem to allow for most of the
same resource requirements as are placed on the job. Notably, this permits
reservations to now reserve GRES directly.
- Details of changes:
* Fix scontrol update job=... TimeLimit+=/-= when used with a raw JobId of job
array element.
* Reject TimeLimit increment/decrement when called on job with
TimeLimit=UNLIMITED.
* Fix issue with requesting a job with *licenses as well as
OBS-URL: https://build.opensuse.org/request/show/1138332
OBS-URL: https://build.opensuse.org/package/show/network:cluster/slurm?expand=0&rev=284
87 lines
2.8 KiB
Diff
87 lines
2.8 KiB
Diff
From d51d3e1db8b2ed650a042352eff041ae77e467f9 Mon Sep 17 00:00:00 2001
|
|
From: Egbert Eich <eich@suse.com>
|
|
Date: Mon, 20 Feb 2023 21:29:27 +0100
|
|
Subject: [PATCH] pam_slurm: Initialize arrays and pass sizes
|
|
|
|
PAM is security critical:
|
|
- clear arrays
|
|
- ensure strings are NULL-terminated.
|
|
|
|
Signed-off-by: Egbert Eich <eich@suse.com>
|
|
Originally-from: Sebastian Krahmer <krahmer@suse.com>
|
|
Signed-off-by: Egbert Eich <eich@suse.de>
|
|
---
|
|
contribs/pam/pam_slurm.c | 20 +++++++++++---------
|
|
1 file changed, 11 insertions(+), 9 deletions(-)
|
|
|
|
diff --git a/contribs/pam/pam_slurm.c b/contribs/pam/pam_slurm.c
|
|
index a27e651548..eac9879c07 100644
|
|
--- a/contribs/pam/pam_slurm.c
|
|
+++ b/contribs/pam/pam_slurm.c
|
|
@@ -279,9 +279,9 @@ static int
|
|
_gethostname_short (char *name, size_t len)
|
|
{
|
|
int error_code, name_len;
|
|
- char *dot_ptr, path_name[1024];
|
|
+ char *dot_ptr, path_name[1024] = {0};
|
|
|
|
- error_code = gethostname(path_name, sizeof(path_name));
|
|
+ error_code = gethostname(path_name, sizeof(path_name) - 1);
|
|
if (error_code)
|
|
return error_code;
|
|
|
|
@@ -309,13 +309,13 @@ static int
|
|
_slurm_match_allocation(uid_t uid)
|
|
{
|
|
int authorized = 0, i;
|
|
- char hostname[HOST_NAME_MAX];
|
|
+ char hostname[HOST_NAME_MAX] = {0};
|
|
char *nodename = NULL;
|
|
job_info_msg_t * msg;
|
|
|
|
slurm_init(NULL);
|
|
|
|
- if (_gethostname_short(hostname, sizeof(hostname)) < 0) {
|
|
+ if (_gethostname_short(hostname, sizeof(hostname) - 1) < 0) {
|
|
_log_msg(LOG_ERR, "gethostname: %m");
|
|
return 0;
|
|
}
|
|
@@ -438,7 +438,7 @@ _send_denial_msg(pam_handle_t *pamh, struct _options *opts,
|
|
*/
|
|
extern void libpam_slurm_init (void)
|
|
{
|
|
- char libslurmname[64];
|
|
+ char libslurmname[64] = {0};
|
|
|
|
if (slurm_h)
|
|
return;
|
|
@@ -446,10 +446,10 @@ extern void libpam_slurm_init (void)
|
|
/* First try to use the same libslurm version ("libslurm.so.24.0.0"),
|
|
* Second try to match the major version number ("libslurm.so.24"),
|
|
* Otherwise use "libslurm.so" */
|
|
- if (snprintf(libslurmname, sizeof(libslurmname),
|
|
+ if (snprintf(libslurmname, sizeof(libslurmname) - 1,
|
|
"libslurm.so.%d.%d.%d", SLURM_API_CURRENT,
|
|
SLURM_API_REVISION, SLURM_API_AGE) >=
|
|
- sizeof(libslurmname) ) {
|
|
+ sizeof(libslurmname) - 1) {
|
|
_log_msg (LOG_ERR, "Unable to write libslurmname\n");
|
|
} else if ((slurm_h = dlopen(libslurmname, RTLD_NOW|RTLD_GLOBAL))) {
|
|
return;
|
|
@@ -458,8 +458,10 @@ extern void libpam_slurm_init (void)
|
|
libslurmname, dlerror ());
|
|
}
|
|
|
|
- if (snprintf(libslurmname, sizeof(libslurmname), "libslurm.so.%d",
|
|
- SLURM_API_CURRENT) >= sizeof(libslurmname) ) {
|
|
+ memset(libslurmname, 0, sizeof(libslurmname));
|
|
+
|
|
+ if (snprintf(libslurmname, sizeof(libslurmname) - 1, "libslurm.so.%d",
|
|
+ SLURM_API_CURRENT) >= sizeof(libslurmname) - 1) {
|
|
_log_msg (LOG_ERR, "Unable to write libslurmname\n");
|
|
} else if ((slurm_h = dlopen(libslurmname, RTLD_NOW|RTLD_GLOBAL))) {
|
|
return;
|
|
--
|
|
2.42.1
|
|
|