> -----Original Message-----
> From: Testbed Support for GridPP member institutes [mailto:TB-
>
> On 23 Mar 2011, at 16:45, Ewan MacMahon wrote:
>
> > It's all very well digging into the history of how long glExec has
> > been talked about, but the amount of time between a major VO actually
> > showing any interest in it and then demanding it's wide deployment is
> > much, much shorter, and much more relevant.
> >
>
> As I understood it - no major VO is demanding wide deployment of glexec.
>
Well as I understand it the current security policy exemption which
allows mutli-user pilot jobs without glExec ID switching is going to
go away at some point (though I'm not completely clear whether that
point is June, some other time, or not actually decided). At that
point anyone using multi-user pilot jobs is going to have to either
use glExec in full SUID ID switching mode, or stop running multiuser
pilot jobs.
I did (sortof) ask about this the other day when Dave Kelsey posted
about the updated security policies, and his answer was:
"The policy exemption is discussed and agreed by the WLCG MB - last
statement is that Tier2s should aim to be compliant by end of June
2011."
Which doesn't strictly speaking say that the exemption is going away
in June, but sounds like a hint in that direction to me. It is, of
course, not the Tier2s that are out of compliance with the policy -
it's the VOs.
So, AIUI, the demand (particularly from ATLAS) is that analysis sites
have working glExec in place before they get their exemption taken away,
which not be long now.
Ewan
|