Univa Grid Engine (execd spooling with Docker jobs on root_squash): MULTI-TENANT ISOLATION: In the specific combination

Impact

MULTI-TENANT ISOLATION: In the specific combination of Docker-based jobs plus execd spooling on a root_squash NFS mount, Grid Engine creates spool files that are world-writable. The spool is what the execution daemon reads to decide what to run, so any tenant who can write to it controls job execution on that node.

Who can reach it

Any user who can reach the shared spool directory - on a root_squash NFS export, that is anyone with the mount, i.e. every compute node.

What to do

Upgrade Univa Grid Engine to 8.6.3 or later (the release notes cover this through 8.6.6). Then audit the modes on the execd spool directory directly - the fix changes what new files get, not what existing files already have. Univa is now Altair, so support for this line runs through Altair.

References