Access to pilot output and jdl files of other users

[ernstpijper]

Hi,

DIRAC py3 server 7.3.17, py3 pilot jobs and py3 diracos2 client

We noticed that users can access the pilot output and jdl input files (and maybe more) of other users. Access to the input sandbox of other users is denied, as it should.

Is this something that should we should allow? Is there maybe an option to turn off this 'feature'?

Thanks,
Ernst

[ernstpijper]

We are still wondering about this situation. Did I perhaps not configure something properly?

If in settings if I choose a certain group (not admin), I can also see jobs of users not in that group. I cannot check
on dirac.egi.eu anymore to see if the same thing is happening there. I used to have access but not anymore. Now i'm just a visitor :(

If this is what it is at the moment, that's ok for me. I just want some clarity about this.

Thanks,
Ernst

[andresailer]

In the relevant group, in /Registry/Groups/TheGroup/Properties, is there JobSharing?
If you remove that, does it fix the issue? Maybe the JobMonitor (JobManager) services (or more) need to be restarted to reflect the config change.

[ernstpijper]

I'm sorry to tell you that I don't use that property.

[andresailer]

What properties do you have?

[ernstpijper]

I only have Properties = NormalUser

[andresailer]

Ok, I understand, you are not talking about the web interface, but the dirac-wms-job-get-jdl commands. Indeed those let you download jdls that do not belong to you. I think this is probably a bug.

[fstagni]

Unless for some reason you are running something quite different, normally ALL pilots jobs are owned by 1 user (and these pilots will match the jobs of all the users). Just for my info, is that user running the pilots yourself?

[andresailer]

I can also see the pilots when I am not the owner of all of them in a v7r3 instance, and v8, and also one other person, that doesn't own the pilots can see the pilots in my v7r2 instance.

[ernstpijper]

Yes that's what I see. I managed to access dirac.egi.eu again. I can see lots of pilot jobs from different groups, and I can access the corresponding pilot outputs (although sometimes it hangs).

No the user is not running pilot jobs himself.

Ah yes pilots jobs are owned by a single pilot user, although the pilot user can be different for different groups, right.

So what you are saying is the use of pilot jobs means that the pilot job output can be viewed by all users. If that's the case then I suppose that is just the way it is.

[fstagni]

I think we have still someone running v7r1 (to see if something changed). @hmiyake would you please check on your instance what you see?

[hmiyake]

Today(!) we have moved to v7r2.
Anyway, what we observe is NormalUser can access any JDL (by both web and dirac-wms-job-get-jdl) while sandbox access is limited.
We haven't configured /Services/JobMonitoring/GlobalJobsInfo.

Both dirac-admin-get-job-pilot-output and WebApp allow for NormalUser to retrieve pilot output but the situation is a bit complicated (probably related to CE type and SD option GetPilotOutput (we are enabling this option for various sites))

[fstagni]

From @atsareg

Right now technically it is not possible to limit user to be able to see only their pilot outputs and JDLs. Pilot outputs can be fully protected from access by "Normal" users without special rights. Other job artefacts like JDLs can be accessed by users in a restricted way but this needs development.

[ernstpijper]

Hi Federico,

Thanks for the all effort in answering my questions. I understand now better what the possibilities and limitations are.