-
Notifications
You must be signed in to change notification settings - Fork 183
Closed
Copy link
Description
JobManager
if a client calls killJob
, DIRAC itself will call a client, with DIRAC "auth power".
Why
- At the beginning,
killJob
is in an handler with DIRAC credentials and not the user's. - After [9.0] Move the logic out of the server (cleaning and deleting jobs) #8244 's refactoring,
filterJobStateTransition
callsres = JobMonitoringClient().getJobsStatus(jobIDs)
which is bad because it is with DIRAC credentials, and not the user's.
Impact
- In DIRAC, "it works" as DIRAC has its own credentials, but it's not an expected behaviour.
- With DiracX, it maybe won't work as DIRAC is not a valid user in the CS.
- In CI with DiracX (how it was detected), it won't work because DIRAC own certificate used for DiracX does not exist:
AssertionError: FileNotFoundError(2, 'No such file or directory'): [Errno 2] No such file or directory: '/tmp/x509up_u501'
# Stack
68.117.5]:57294)[prod:ciuser] (0.13 secs) ERROR: FileNotFoundError(2, 'No such file or directory'): [Errno 2] No such file or directory: '/tmp/x509up_u501'
File "/home/dirac/LocalRepo/ALTERNATIVE_MODULES/DIRAC/src/DIRAC/Core/Utilities/ReturnValues.py", line 238, in wrapped
value = func(*args, **kwargs)
^^^^^^^^^^^^^^^^^^^^^
File "/home/dirac/LocalRepo/ALTERNATIVE_MODULES/DIRAC/src/DIRAC/WorkloadManagementSystem/FutureClient/JobMonitoringClient.py", line 35, in getJobsStatus
return self.fetch(["Status"], jobIDs)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/home/dirac/LocalRepo/ALTERNATIVE_MODULES/DIRAC/src/DIRAC/WorkloadManagementSystem/FutureClient/JobMonitoringClient.py", line 10, in fetch
with DiracXClient() as api:
File "/home/dirac/ServerInstallDIR/diracos/lib/python3.11/contextlib.py", line 137, in __enter__
return next(self.gen)
^^^^^^^^^^^^^^
File "/home/dirac/LocalRepo/ALTERNATIVE_MODULES/DIRAC/src/DIRAC/Core/Security/DiracX.py", line 99, in DiracXClient
diracxToken = diracxTokenFromPEM(proxyLocation)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/home/dirac/LocalRepo/ALTERNATIVE_MODULES/DIRAC/src/DIRAC/Core/Security/DiracX.py", line 77, in diracxTokenFromPEM
pem = Path(pemPath).read_text()
^^^^^^^^^^^^^^^^^^^^^^^^^
File "/home/dirac/ServerInstallDIR/diracos/lib/python3.11/pathlib.py", line 1058, in read_text
with self.open(mode='r', encoding=encoding, errors=errors) as f:
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/home/dirac/ServerInstallDIR/diracos/lib/python3.11/pathlib.py", line 1044, in open
return io.open(self, mode, buffering, encoding, errors, newline)
Note: Maybe there's other weird calls like this... We only detected it because of the CI with DiracX