David.Singleton at anu.edu.au
Thu Jun 25 04:57:37 MDT 2009
Gus Correa wrote:
> Hi David, list
> David Singleton wrote:
>> Gus Correa wrote:
>>> Hi Jon, Troy, list
>>> Besides Troy's suggestions:
>>> Ole Holm Nielsen wrote a suite of scripts to do Torque/PBS accounting
>>> I never tried it,
>>> but would guess a prologue script may be able to do #2 also,
>>> say, by checking if the project number is on a list of projects,
>>> and returning an abort exit code (1),
>>> if the project is not valid:
>>> However, this may reject the job only when it starts,
>>> not right after qsub, like Troy's "qsub filter" would do.
>>> In other words, the prologue solution defers the job deletion to run time.
>>> My doubt is how to enforce the use of the "qsub filter",
>>> instead of the actual qsub command.
>>> I suppose the user could always write the full path to qsub, instead of
>>> the filter alias.
>> Or they could build/install their own qsub ... or they could call pbs_submit()
>> directly ... Not many users would but if you have enough users ...
>> In the end, we decided the "right" solution was to put hooks in the server's
> Short from Teddy Roosvelt's
> "Speak softly, and carry a big stick",
> your and Naveed's suggestions are the best I heard of
> to handle rogue behavior on the Torque queue system.
> I am amazed by the Aussie user creativity!
> Our rogue's gallery is small, if any,
> but we are a small community, the focus is not computer science.
> Any hints on how to patch-n-hook the server's req_quejob.c?
Actually, for what Jon wanted, there is already a hook. In
src/lib/Libsite/site_check_u.c, there is the following stub
which is called from the right place in the server (actually
in svr_jobfunc.c:svr_chkque()). You could implement an
account charging check similar to that indicated. You need
to supply int valid_acct_request(char *user, char *acct)
that does whatever check you want. You might want something
more complicated like dependence on queue etc.
Users can have default accounts on our system so our equivalent
of this routine sets the account value if not provided as well
as checking the value if it is provided.
PS: dont trust my code!
* site_check_u - site_acl_check()
* This routine is a place holder for sites that wish to implement
* access controls that differ from the standard PBS user, group, host
* access controls. It does NOT replace their functionality.
* Return PBSE_PERM for access denied or some other PBS error code,
* otherwise 0 for ok.
* Account verification version: checks that the user has specified
* an account and then verifies she can use that account. qsub
* will return an "Invalid Account" message in case of failure.
int site_acl_check(job *pjob, pbs_queue *pque)
attribute *pjattr = pjob->ji_wattr;
char *user, *acct;
if ( !(pjattr[(int)JOB_ATR_euser].at_flags & ATR_VFLAG_SET) )
return PBSE_BADUSER; /* ? How? */
user = pjob->ji_wattr[(int)JOB_ATR_euser].at_val.at_str;
if ( !(pjattr[(int)JOB_ATR_account].at_flags&ATR_VFLAG_SET) )
return PBSE_BADACCT; /* No account specified */
acct = pjattr[(int)JOB_ATR_account].at_val.at_str
if ( !valid_acct_request(user, acct) )
return PBSE_BADACCT; /* Not a valid acct or user
cannot use the acct */
More information about the torqueusers