Re: [HTCondor-users] Submit classad whitelist

[Jason Patton <jpatton@xxxxxxxxxxx>]

Hi David,

We do provide some configuration macros to provide a set of attributes that cannot be changed once set, and furthermore you can enforce certain values using either submit transforms (to override user-given values) or submit requirements (to enforce that users set certain values). The config macros of note are the four starting here:

https://htcondor.readthedocs.io/en/latest/admin-manual/configuration-macros.html#IMMUTABLE_JOB_ATTRS

I know these don't really solve the question of how to whitelist attributes, can you maybe describe a little more about the scenario that you're trying to solve or prevent?

Jason Patton

On Tue, May 4, 2021 at 7:52 AM <duduhandelman@xxxxxxxxxxx> wrote:

Hi All,

I have some security concerns regarding unknown job classads.

The goal is to allow users submitting a job with very limited job classads for example

Allow only:

requestmemory

universe

stream_outout

job_lease_duration

Is there any way to accomplish this?

Many Thanks

David.

_______________________________________________
HTCondor-users mailing list
To unsubscribe, send a message to htcondor-users-request@xxxxxxxxxxx with a
subject: Unsubscribe
You can also unsubscribe by visiting
https://lists.cs.wisc.edu/mailman/listinfo/htcondor-users

The archives can be found at:
https://lists.cs.wisc.edu/archive/htcondor-users/