IBM Spectrum LSF (job submission, file permissions): MULTI-TENANT ISOLATION: Weak file permissions in the LSF install

Impact

MULTI-TENANT ISOLATION: Weak file permissions in the LSF install let a local user change the user a job is submitted as. On a shared GPU cluster that means running your workload under someone else's identity, charged to their account and with access to their data.

Who can reach it

A local user on an LSF submission host, affecting LSF 9.1.1, 9.1.2, 9.1.3 and 10.1.

What to do

Apply IBM's LSF fix pack and, separately, tighten the permissions on the LSF configuration and binary directories - the underlying issue is filesystem mode, so the correct modes need to be verified after every LSF upgrade, not just once.

References