Slurm (srun --uid): Srun --uid drops privileges in the wrong order, so a step launched through it can end up running

Impact

Srun --uid drops privileges in the wrong order, so a step launched through it can end up running with more privilege than the target user should have. On a shared cluster this is a path from an admin-adjacent account to code execution as, or above, another tenant.

Who can reach it

A local user able to invoke srun with --uid on a login or submit node.

What to do

Upgrade to Slurm 18.08.9 or 19.05.5 and restart slurmctld and slurmd. If you cannot upgrade immediately, remove --uid from any operator tooling and wrapper scripts that run as root.

References