Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

The title kinda says it all...

We're using SGE/OGE to submit jobs to a set of worker nodes that then do things with specific pieces of equipment. The programs and scripts that have been created that manipulate this equipment rely on running as root. I'd like SGE to handle allocation of resources in a way that is mindful of users, groups, projects, etc., but I also need the actual jobs to run with root permissions.

I've read up on How can one run a prologue script as root in gridengine? to see if anything there was pertinent, but it seems that SGE is providing the "user@" kind of spec specifically for prolog and epilog kinds of actions. Is there any similar functionality for the job itself?

I'm aware of su/sudo approaches, but that won't really work in this environment because the sudoers file isn't globally managed (i.e. I'd have to add a whole set of users to /etc/sudoers on lots of machines). I'm currently looking into a setuid kind of solution, but that would definitely be an unnecessary kind of work-around if SGE provides me a way to declare that a specific job (or jobs in a specific queue) always needs to run with a specific user's rights.

share|improve this question
add comment

2 Answers

I doubt SGE has any way to do this.

I suspect you'll have to go the setuid route and write a wrapper and deploy it to your nodes. Of course, unless your wrapper is bulletproof, you just created a huge security hole.

share|improve this answer
add comment

Gridengine doesn't seem to provide any facility to run configure a particular job to run as root or any other user.

One way I can see this being implemented is if you created a separate queue and set that queue's shell to a command which starts a shell as root. You would then need to create a forced complex for that queue to prevent other jobs from running in it, and the jobs which you do want to run in it would have to request that complex.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.