Repository navigation
Restricting the user that spawns ECF_*_CMD - #469
Open
marcosbento wants to merge 4 commits into
Open
marcosbento wants to merge 4 commits into
marcosbento wants to merge 4 commits into
Conversation
marcosbento
force-pushed
the
task/restrict_owner
branch
2 times, most recently
from
September 29, 2026 14:44
f4abf9a to
1750d49
Compare
Codecov Report❌ Patch coverage is Additional details and impacted files@@ Coverage Diff @@
## develop #469 +/- ##
===========================================
+ Coverage 56.69% 56.94% +0.24%
===========================================
Files 1265 1272 +7
Lines 105999 106660 +661
Branches 15403 15443 +40
===========================================
+ Hits 60101 60733 +632
- Misses 45898 45927 +29 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
marcosbento
force-pushed
the
task/restrict_owner
branch
from
October 8, 2026 11:44
551063c to
1849192
Compare
Every task and alias records the login name of the user whose command put it in a state from which a job is spawned: load and replace on the nodes they add; requeue, run, force to queued and the submission of an edited script on the nodes they act on. Begin and automatic requeues leave it unchanged. The owner is the generated variable ECF_OWNER, which job generation resolves before any user variable of that name, as for ECF_HOST and ECF_PASS. It is kept in the checkpoint as the token "owner:<user>", sent to clients with the task memento, compared by the node equality, and exposed in Python through get_owner().
marcosbento
force-pushed
the
task/restrict_owner
branch
from
October 10, 2026 18:49
1849192 to
dc7c0ca
Compare
Read a JSON server configuration file beside server_environment.cfg, <host>.<port>.server.cfg when it exists and server.cfg otherwise. Its only setting, spawn_as_owner, declares that jobs are to run as their owner; it is off without the file. A file that is not valid JSON, a setting of the wrong type or an unknown one stops the server from starting, as does the flag on a server that is not root, since only root can switch user. The mode is logged at start-up and shown in the --debug dump.
With spawn_as_owner set, the server resolves the owner of a task to a system account before forking, and the child switches to it before executing the command: - job, kill and status commands run with the account's uid and gid, and with HOME, USER, LOGNAME and SHELL taken from it; - an empty owner, an unknown user or root is refused: nothing runs, the refusal is logged and becomes the abort reason of the task; - a kill or status runs as the user that requested it, or as the owner when nothing did.
- server.cfg, under the start-up files: location and precedence, the JSON form, the spawn_as_owner setting, the faults that stop the server; - Running jobs as their owner, under Security: the owner, what the server does at spawn time, the refusals, what the host needs, and a warning against enabling the switch for unauthenticated users; - links from the ECF_OWNER section and the Kubernetes Cookbook page.
marcosbento
force-pushed
the
task/restrict_owner
branch
from
October 11, 2026 08:56
dc7c0ca to
6548a7d
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
As per PR title -- see commit messages for details.
Contributor Declaration
By opening this pull request, I affirm the following:
🌦️ >> Documentation << 🌦️
https://sites.ecmwf.int/docs/dev-section/ecflow/pull-requests/PR-469