[torqueusers] Question regarding configuring a queue with acl_groups

Michael Homa mhoma at uic.edu
Tue Aug 12 14:24:47 MDT 2008


So I'm still stuck on my original problem, trying to figure out why a
-student entry in the queue staff does not work:
  Qmgr: list queue staff  acl_groups
Queue staff
        acl_groups = -student

I've added debugging code to routine svr_chkque in the svr_jobfunc.c.
file. One section of code that is confusing to me is the acl_check call:

      rc = acl_check(
         &pque->qu_attr[QA_ATR_AclGroup],
         pjob->ji_wattr[(int)JOB_ATR_egroup].at_val.at_str,
         ACL_Group);

If my read of this function is correct, the
"&pque->qu_attr[QA_ATR_AclGroup]" contains the "-student" and, ACL_Group
contains a 3 (defined in attriubte.h). But, I'm lost in terms of the 2nd
field (pjob->ji_wattr[(int)JOB_ATR_egroup].at_val.at_str). What ACL is it
looking at? The actual staff queue file in server_priv/queues? Something
else? I've taken a look at the job.h and attribute.h files but they are a
bit difficult to decipher.

If someone could point me in the right direction, that would great. All
I'm trying to do is create a queue for jobs submitted anyone who is not
in the group students.

Michael Homa
Operating Systems Support and Database Group
Academic Computing and Communication Center
University of Illinois at Chicago
email:  mhoma at uic.edu

On Wed, 6 Aug 2008, Michael Homa wrote:

> I'm configuring torque (version 2.2.1) for a university-based cluster. I'm
> setting up an execution queue for jobs submitted by staff employees and not
> from students; I've already established queues for students). I've
> configured the "staff" queue with the key attributes:
>
>    acl_user_enable = True
>    acl_group_enable = True
>    acl_logic_or = True    <-- added to try solving my problem
>    acl_groups = -student
>
> No accounts entered for acl_user entry. (Again, the acl_logic_or as well
> as the acl_user_enable were added in an attempt to solve my problem.)
>
> According to the PBS ERS and pbs_queue_attributes(7) man page, the (not
> group) is permitted with the -<group_name> entry
>
> I've created a test account with the following attributes:
>    uid=52180(mhoma) gid=1234(mpitest) groups=100(users),1234(mpitest)
>
> The /etc/group file confirms that mpitest exists with mhoma:
>    mpitest:x:1234:mhoma
>
> I've confirmed that -students is in the appropriate acl_group entry:
>    cd acl_groups
>    ls
>       dedicated  staff  student_long  student_medium  student_short
>    cat staff
>       -student
>
> When I submit a hello_world script to the staff queue (either with the
> script containing the destination staff or via the -q option on qsub
> command):
>
>   #PBS -N hello_world
>   #PBS -q staff
>   /home/homes51/mhoma/a.out
>
> I get a "qsub: Unauthorized Request". So I set up a test matrix of the two
> key queue attributes (acl_group_sloppy and acl_group) and the results of
> qsub results:
>
>    +---------------------------------------------------------------+
>    | acl_group_sloppy  |  acl_group  |    Results                  |
>    +-------------------+-------------+-----------------------------+
>    |        true       |   mpitest   | job queued as expected      |
>    |        false      |   mpitest   | failed though I expected it |
>    |                                     to queue                  |
>    |        false      |   -student  | failed - not expected       |
>    |        true       |   -student  | failed - not expected       |
>    +---------------------------------------------------------------+
>
> So, I'm at a loss as to why the NOT student does not work. I tried
> changing the server log_level to 7 to get additional information. No
> additional information. I added the @localhost to the acl_groups
> entry. Same result. I also tried the -W group_list=mpitest on the
> qsub command. If someone knows which src program contains the
> appropriate code, I can look at the logic. Is there any way (I don't
> see any looking at the docs) to generate a more detailed explanation of
> why the request failed? Or, if I'm trying to do something not permitted
> or just being stupid (after spending eight hours on this particular
> problem, I would not discount the latter), let me know because I'm out
> of ideas.
>
> Sorry for the length of the note.
>
> Michael Homa
> Operating Systems Support and Database Group
> Academic Computing and Communication Center
> University of Illinois at Chicago
> email:  mhoma at uic.edu
>
> _______________________________________________
> torqueusers mailing list
> torqueusers at supercluster.org
> http://www.supercluster.org/mailman/listinfo/torqueusers
>


More information about the torqueusers mailing list