Difference between revisions of "GLExec"

From PDP/Grid Wiki
Jump to navigationJump to search
 
(77 intermediate revisions by 3 users not shown)
Line 1: Line 1:
−
gLExec is a program that acts as a light-weight 'gatekeeper'. gLExec takes Grid credentials as input. By taking the local site policy into account it '''authenticates''' and '''authorizes''' the credentials. For extra safety gLExec is capable of creating a new execution sandbox based on the Grid credentials. Besides the ''yes''/''no'' control point functionality in the '''logging-only''' mode it can create identity specific sandboxes in the '''identity-switching''' mode.
+
[[Image:MUPJ-CE-WN-gLExec.png|thumb|upright|400px|Multi User Pilot Job with CE & WN]] gLExec is a program that acts as a light-weight 'gatekeeper'. gLExec takes Grid credentials as input. gLExec takes the local site policy into account to '''authenticate''' and '''authorize''' the credentials. gLExec will switch to a new execution '''sandbox''' and execute the given command as the switched identity. gLExec is also capable of functioning as a light-weight control point which offers a binary ''yes''/''no'' result called the logging-only mode.
  
−
= Deployment: Installation and setups =
+
== Current gLExec version ==
  
−
* gLExec on the Worker Nodes
+
The latest stable versions released are:
−
** [[Using generic per-node pool accounts or a shared map database]]
+
* gLite-3.2: 0.8.1
−
** [[Using the SCAS]]
+
* EMI-1: 0.8.10
−
** [[Batch System Interoperability]]
+
* EMI-2: 0.9.6
−
* [[Deployment Scenarios in EGEE and OSG]]
+
* EMI-3: 0.9.11
−
* [[Secure installation considerations]]
 
−
* [[Debugging hints]]
 
  
−
= How To's and FAQ =
+
Latest version available: 0.9.11, released in EMI-3 and UMD-3. Latest OSG release [https://www.opensciencegrid.org/bin/view/Documentation/Release3/WebHome OSG-3] is 0.9.9.
  
−
* To help you master gLExec's security:
+
== User information ==
−
** [[GLExec TransientPilotJobs]] describes how you may go about managing a target workload's transient area in '''Pilot Job Frameworks'''.
 
−
** [[GLExec Environment Wrap and Unwrap scripts]] describes how you can preserve the environment variables between the calling process of gLExec and the user switched side of gLExec. For example: to preserve the environment variables from a Pilot Job Framework, through gLExec and into Pilot Job Payload.
 
  
−
* [[FAQs and misconceptions about gLExec]]
+
* [[Proxy file handling in gLExec]] What do all the '''environment variables''' do with '''proxy''' files
 +
* [[GLExec TransientPilotJobs]] describes how you may go about managing a '''target''' workload's '''directory''' in '''Pilot Job Frameworks'''.
 +
* [[GLExec Environment Wrap and Unwrap scripts]] describes how you can '''preserve''' the '''environment''' variables between the calling process of gLExec and the user switched side of gLExec. For example: to preserve the environment variables from a Pilot Job Framework, through gLExec and into Pilot Job Payload.
  
−
= Online documentation (on other sites) =
+
=== Documentation ===
  
 
* [[Exit codes of gLExec]]
 
* [[Exit codes of gLExec]]
 
* [[Man pages of gLExec]]
 
* [[Man pages of gLExec]]
−
* [[Service Reference Card for gLExec]]
 
−
* [[Papers about gLExec]]
 
  
−
= Deploying gLExec on the worker node =
+
* EMI-2 and EMI-3 information:
 +
** [http://www.nikhef.nl/grid/lcaslcmaps/EMI2_docs/glexec_userguide.pdf EMI-2 User Guide PDF]
  
 +
== Sysadmin information ==
  
 +
=== Deployment: Installation and setups ===
  
 +
* gLExec on the Worker Nodes or Computing Element
 +
** [[Using generic per-node pool accounts or a shared map database]]
 +
** [[GLExec Argus Quick Installation Guide]]
 +
** [[Using the SCAS]]
 +
** [[Batch System Interoperability]]
 +
** [[LCMAPS Tracking GroupID plugin]]
 +
* [[Deployment Scenarios in EGEE and OSG]]
 +
* [[Secure installation considerations]]
 +
* [[Debugging hints]]
 +
* [[GLExec Epilogue Functionality]] (version 0.9 and up)
  
 +
* To help you master gLExec's security:
 +
** [[Need to Know's]]: Explains about the '''LD_LIBRARY_PATH''' in combo with '''setuid''' programs.
 +
** [https://www.nikhef.nl/pub/projects/grid/gridwiki/images/a/ab/Argus-SCAS-note-20100602.pdf Argus and SCAS node dd. June 2nd, 2010]: quick guide on how to decide for either SCAS or Argus as the central service with gLExec.
  
 +
* [[FAQs and misconceptions about gLExec]]
  
 +
See also the [[#Background information|Background information]]
  
 +
=== To help you adapt or rebuild gLExec ===
 +
* [[Building gLExec and its gLite dependencies from SVN source]] How to build gLExec and all its gLite dependencies directly from source.
 +
* [[Building gLExec from src rpm]] How to build gLExec from a source RPM.
  
 +
=== Documentation ===
  
 +
* [[Man pages of gLExec]]
 +
* [[Service Reference Card for gLExec]]
 +
* [[Papers about gLExec]]
  
−
== Need to Know's ==
+
See also the [[#Background information|Background information]]
−
 
 
−
The gLExec executable is installable in two ways, with an without the setuid (file system) bit on root. With the setuid-bit enabled on root, this effectively means that gLExec is being executed with root privileges. Without the setuid or setgid bits on root the gLExec executable is like any other regular executable.
 
−
 
 
−
The safety features of gLExec are implemented with great care to avoid misuse and exploitation by anybody who executes it. As gLExec is typically installed with a setuid bit on root, this effectively means that anybody on the system is able to execute something with root privileges for a brief moment of time to perform the user switch.
 
  
−
A couple of safety features that are build in the gLExec tool are:
+
* EMI-2 and EMI-3 information:
 +
** [http://www.nikhef.nl/grid/lcaslcmaps/EMI2_docs/glexec_funcdesc.pdf EMI-2 Functional Description PDF]
 +
** [http://www.nikhef.nl/grid/lcaslcmaps/EMI2_docs/glexec_servrefcard.pdf EMI-2 Service Reference Card PDF]
 +
** [http://www.nikhef.nl/grid/lcaslcmaps/EMI2_docs/glexec_sysadminguide.pdf EMI-2 System Administrator's Guide PDF]
  
−
* The LD_LIBRARY_PATH, LD_RUN_PATH and other LD_* environment variables are removed from the process environment by the Operating System before the first line of gLExec code is executed by a Unix and Linux system. Only the /etc/ld.so.conf{.d/}, RPATH settings and other system specific paths are used and resolved. This statement holds for '''any''' setuid or setgid executable.
+
== Test plans/reports ==
  
−
* The rest of the environment is stripped off by gLExec. There are a couple of environment settings that can easily lead to a root exploit in the standard library of a Unix and Linux system. Only the GLEXEC_* environment variables are kept. There is an option in the glexec.conf file to preserve more variables, but these must be selected with great care and setup by each System Administrator on all their machines.
+
* [[EMI-1 gLExec release test report]]: This is the report describing the test performed for the software certification of the released components with gLExec.
 +
* [[EMI-2 gLExec release test report]]: This is the report describing the test performed for the software certification of the released components with gLExec.
  
−
* If the target user is authorized and when a mapping and Unix process identity switch the HOME and X509_USER_PROXY will be rewritten. Their value will contain the paths that are relevant for the target user account.
+
== Background information ==
  
−
* The target user process has the Unix identity as mapped by LCMAPS. This could be from a separate set of pool accounts, or the regular set of pool accounts as given by the same user credentials from an LCG-CE or CREAM-CE. It could be a poolaccount defined locally on the machine. The only assumption that holds is that the target user account has the privileges that are appointed to them by the local site administrator.
+
* [https://twiki.cern.ch/twiki/bin/view/LCG/GlexecDeployment LCG Deployment of gLExec on the Worker Node]
 +
* [https://wlcg-tf.hep.ac.uk/wiki/Multi_User_Pilot_Jobs Multi User Pilot Jobs]

Latest revision as of 12:19, 4 March 2015

Multi User Pilot Job with CE & WN

gLExec is a program that acts as a light-weight 'gatekeeper'. gLExec takes Grid credentials as input. gLExec takes the local site policy into account to authenticate and authorize the credentials. gLExec will switch to a new execution sandbox and execute the given command as the switched identity. gLExec is also capable of functioning as a light-weight control point which offers a binary yes/no result called the logging-only mode.

Current gLExec version

The latest stable versions released are:

  • gLite-3.2: 0.8.1
  • EMI-1: 0.8.10
  • EMI-2: 0.9.6
  • EMI-3: 0.9.11

Latest version available: 0.9.11, released in EMI-3 and UMD-3. Latest OSG release OSG-3 is 0.9.9.

User information

  • Proxy file handling in gLExec What do all the environment variables do with proxy files
  • GLExec TransientPilotJobs describes how you may go about managing a target workload's directory in Pilot Job Frameworks.
  • GLExec Environment Wrap and Unwrap scripts describes how you can preserve the environment variables between the calling process of gLExec and the user switched side of gLExec. For example: to preserve the environment variables from a Pilot Job Framework, through gLExec and into Pilot Job Payload.

Documentation

Sysadmin information

Deployment: Installation and setups

See also the Background information

To help you adapt or rebuild gLExec

Documentation

See also the Background information

Test plans/reports

Background information

Retrieved from "https://wiki.nikhef.nl/grid/index.php?title=GLExec&oldid=9629"