David McBride wrote:
> Are offsite resource brokers really supposed to be submitting jobs to be
> executed with the "fork" Globus jobmanager on my CE node?
Yes, to launch the grid_monitor, which will look after the user's jobs.
> I'd very much like to disable the fork jobmanager on the CE and not
> allow any offsite user to run arbitrary code on my frontend server!
We plan to make the fork jobmanager only allow certain executables
to be started by arbitrary users, while allowing privileged DNs to
run anything. For example, any dteamsgm could be allowed to use
the fork jobmanager to debug a remote CE. Hopefully we can still
get this into LCG-2_7_0.
> If I do this, will anything break horribly? Or would I try to find the
> chaps who wrote the RB server code and twist their arm so that they
> don't need to do this?
It is already being worked on for a few years now...
|