Slurm (slurmdbd accounting, Coordinator role): MULTI-TENANT ISOLATION: A Coordinator - the delegated role a site gives

Impact

MULTI-TENANT ISOLATION: A Coordinator - the delegated role a site gives a team lead over their own account - can promote a user to full Slurm Administrator. That collapses the boundary between per-tenant account admin and cluster-wide admin, which on a multi-tenant GPU cluster means one team's lead can rewrite every other tenant's limits, QOS and fairshare.

Who can reach it

A user holding Coordinator on any account in the accounting database. Coordinators are commonly handed out to per-project leads, so the population that can exploit this is larger than it sounds.

What to do

Upgrade to Slurm 23.11.11, 24.05.8 or 24.11.5 and restart slurmdbd. Then audit the admin level of every user in sacctmgr and revoke any Administrator grant you did not issue yourself.

References