Fix/CVE 2023 41914 - Githubissues

stackhpc / ansible-slurm-appliance

A Slurm-based HPC workload management environment, driven by Ansible.

36 stars 15 forks source link

Fix/CVE 2023 41914 #319

Closed sjpb closed 8 months ago

sjpb commented 8 months ago

Provides a new role 'cve-2023-41914' and playbook ansible/adhoc/cve-2023-41914.yml to mitigate Slurm CVE-2023-41914. See ansible/roles/cve-2023-41914/README.md for full details.
Builds a new fat image in CI with the above fix for Azimuth-deployed clusters

TODO: describe testing

sjpb commented 8 months ago

Cancelled CI, image build running here: https://github.com/stackhpc/ansible-slurm-appliance/actions/runs/6576190363

sjpb commented 8 months ago

fatimage build: https://github.com/stackhpc/ansible-slurm-appliance/actions/runs/6576343545/job/17866599952

sjpb commented 8 months ago

Put up cluster, ran hpctests, ran adhoc, ran hpctests again, checked:

All 8x jobs visible in slurm jobs dashboard
OOD portal page works
OOD shell works
remote desktop works
jupyter works

sjpb commented 8 months ago

fat image build with packer on-error=abort to try to debug ssh failures: https://github.com/stackhpc/ansible-slurm-appliance/actions/runs/6576988250/job/17867609363

sjpb commented 8 months ago

fatimage build with profiling for timestamps: https://github.com/stackhpc/ansible-slurm-appliance/actions/runs/6577282272/job/17868582177

sjpb commented 8 months ago

fatimage build with wait_for_connection: https://github.com/stackhpc/ansible-slurm-appliance/actions/runs/6577484058

sjpb commented 8 months ago

fatimage build with pause + wait_for_connection: https://github.com/stackhpc/ansible-slurm-appliance/actions/runs/6577707595

sjpb commented 8 months ago

Closing due to sms fixes, see clean version https://github.com/stackhpc/ansible-slurm-appliance/pull/320