Ticket 6019

Summary:	pam_slurm_adopt and XDG variable
Product:	Slurm	Reporter:	Marco Induni <marco.induni>
Component:	Other	Assignee:	Felip Moll <felip.moll>
Status:	RESOLVED DUPLICATE	QA Contact:
Severity:	4 - Minor Issue
Priority:	---	CC:	bart, felip.moll
Version:	17.11.12
Hardware:	Linux
OS:	Linux
See Also:	https://bugs.schedmd.com/show_bug.cgi?id=5920
Site:	CSCS - Swiss National Supercomputing Centre	Alineos Sites:	---
Atos/Eviden Sites:	---	Confidential Site:	---
Coreweave sites:	---	Cray Sites:	---
DS9 clusters:	---	Google sites:	---
HPCnow Sites:	---	HPE Sites:	---
IBM Sites:	---	NOAA SIte:	---
NoveTech Sites:	---	Nvidia HWinf-CS Sites:	---
OCF Sites:	---	Recursion Pharma Sites:	---
SFW Sites:	---	SNIC sites:	---
Tzag Elita Sites:	---	Linux Distro:	---
Machine Name:		CLE Version:
Version Fixed:		Target Release:	---
DevPrio:	---	Emory-Cloud Sites:	---

Description Marco Induni 2018-11-12 09:04:52 MST

Dear support,
I followed the instructions (https://slurm.schedmd.com/pam_slurm_adopt.html) to limit the access on the compute nodes where there is a JOB running and it works.
I have only a problem discovered, because some environment variables now aren't set anymore.
Indeed based on the instruction you should comment out in the /etc/pam.d/system-auth the following

#account    sufficient    pam_localuser.so
#-session   optional      pam_systemd.so

The problem is that pam_systemd set for example all the XDG variables (and maybe others) and since they are used on our environment, now some applications doesn't work any more.

Is there a way to get these variable set again ?

Thank you
Marco Induni

Comment 2 Felip Moll 2018-11-12 11:38:58 MST

(In reply to Marco Induni from comment #0)
> Dear support,
> I followed the instructions (https://slurm.schedmd.com/pam_slurm_adopt.html)
> to limit the access on the compute nodes where there is a JOB running and it
> works.
> I have only a problem discovered, because some environment variables now
> aren't set anymore.
> Indeed based on the instruction you should comment out in the
> /etc/pam.d/system-auth the following
> 
> #account    sufficient    pam_localuser.so
> #-session   optional      pam_systemd.so
> 
> The problem is that pam_systemd set for example all the XDG variables (and
> maybe others) and since they are used on our environment, now some
> applications doesn't work any more.
> 
> Is there a way to get these variable set again ?
> 
> Thank you
> Marco Induni

Hi Marco,

I have a related bug about this, but I would really like to know
exactly what are the needed variables that are now missing.

Could you run some test and provide me with this info?
That would help a lot.

Thanks

Comment 3 Marco Induni 2018-11-13 01:30:32 MST

(In reply to Felip Moll from comment #2)
> (In reply to Marco Induni from comment #0)
> > Dear support,
> > I followed the instructions (https://slurm.schedmd.com/pam_slurm_adopt.html)
> > to limit the access on the compute nodes where there is a JOB running and it
> > works.
> > I have only a problem discovered, because some environment variables now
> > aren't set anymore.
> > Indeed based on the instruction you should comment out in the
> > /etc/pam.d/system-auth the following
> > 
> > #account    sufficient    pam_localuser.so
> > #-session   optional      pam_systemd.so
> > 
> > The problem is that pam_systemd set for example all the XDG variables (and
> > maybe others) and since they are used on our environment, now some
> > applications doesn't work any more.
> > 
> > Is there a way to get these variable set again ?
> > 
> > Thank you
> > Marco Induni
> 
> Hi Marco,
> 
> I have a related bug about this, but I would really like to know
> exactly what are the needed variables that are now missing.
> 
> Could you run some test and provide me with this info?
> That would help a lot.
> 
> Thanks

Dear Felip,
as a test I logged on a node with the configuration adopt enabled and a second time with the adopt disabled and these are the missing variables:

XDG_RUNTIME_DIR=/run/user/22447
XDG_SESSION_ID=8863

If you need that I have to run a specific test or you need something else, just let me know.

Thank you
Marco

Comment 4 Marco Induni 2019-01-28 23:58:28 MST

Any update on this ?

Kind regards,
Marco I.

Comment 5 Felip Moll 2019-01-30 07:39:45 MST

(In reply to Marco Induni from comment #4)
> Any update on this ?
> 
> Kind regards,
> Marco I.

Hi Marco,

Not yet. The issue is not easy. The pam systemd module just
modifies the cgroup and overwrites what the pam slurm does.

If you remove pam systemd these variables are not set, and we
cannot recreate them because the values of the session ID
comes from a new session generated by the pam systemd module.

I am studying again what options do we have.

Will inform you as soon as we've any conclusion.

Comment 6 Felip Moll 2019-02-15 10:26:14 MST

Hi Marco,

I am marking this bug as a duplicate of bug 5920. We are discussing there
a fix for this issue which would solve your situation.

Please, add yourself to bug 5920 and feel free to reply there if you have
questions.

*** This ticket has been marked as a duplicate of ticket 5920 ***