Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Run the GEOPM service as an unprivileged user #3348

Draft
wants to merge 1 commit into
base: dev
Choose a base branch
from

Conversation

dannosliwcd
Copy link
Contributor

@dannosliwcd dannosliwcd commented Feb 2, 2024

This is a hard-coded prototype demonstrating what code needs to be touched (not a proposal for actual changes to be made) if we want to optionally run geopmd as a regular user, which may simplify some testing workflows.

Summary of key changes is:

  • We need to be able to customize our /etc and /run paths (either at build time, or at run time should be fine)
  • We need to be able to select between system dbus and session dbus
  • There are several "am I privileged" checks in the code. Some of those are truly intended as privilege checks, but some of them are "am I a client or am I the service" checks. Those need to be separated out. This draft makes a guess, but I'm not sure if I got it completely right.

Usage:

  • Configure with something to put the GEOPM config path on a user-writable location GEOPM_CONFIG_PATH=/tmp/etcgeopm ./configure ...
  • On a compute node, stop any actual instances of the geopm service system stop geopm
  • On the compute node, start a dbus session: dbus-launch. Note the env vars it prints out.
  • Export the env vars printed by dbus-launch. These need to be exported where you run the service, as well as where you run any clients (e.g., geopmread)
  • Run geopmd as GEOPM_IS_SERVICE=1 geopmd
  • Run geopm clients as normal

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

1 participant