Slurm (user_name / gid field handling): Slurm trusts the user_name and gid fields carried in job RPCs instead of

Impact

Slurm trusts the user_name and gid fields carried in job RPCs instead of resolving identity itself, so the identity a job runs under can be steered by whoever crafts the RPC. On a shared cluster that is the first half of running work under someone else's account.

Who can reach it

A tenant who can submit jobs, or anyone who can talk to slurmctld or slurmd on the cluster network.

What to do

Upgrade to Slurm 17.02.11 or 17.11.7 and restart slurmctld and slurmd. Pair the upgrade with a check that MUNGE is actually enforcing authentication on every node - this class of bug is only dangerous when the RPC path is not independently authenticated.

References