CVE-2019-19728

This update for slurm to version 18.08.9 fixes the following issues:

Security issues fixed:

• CVE-2019-19728: Fixed a privilege escalation with srun, where --uid might have unintended side effects (bsc#1159692).
• CVE-2019-12838: Fixed SchedMD Slurm SQL Injection issue (bnc#1140709).
• CVE-2019-19727: Fixed permissions of slurmdbd.conf (bsc#1155784).

Bug fixes:

• Fix ownership of /var/spool/slurm on new installations and upgrade (bsc#1158696).
• Fix %posttrans macro _res_update to cope with added newline (bsc#1153259).
• Move srun from 'slurm' to 'slurm-node': srun is required on the nodes as well so sbatch will work. 'slurm-node' is a requirement when 'slurm' is installed (bsc#1153095).

This update was imported from the SUSE:SLE-15-SP1:Update update project.

These are all security issues fixed in the libnss_slurm2-21.08.1-1.1 package on the GA media of openSUSE Tumbleweed.

This update for slurm to version 18.08.9 fixes the following issues:

Security issues fixed:

• CVE-2019-19728: Fixed a privilege escalation with srun, where --uid might have unintended side effects (bsc#1159692).
• CVE-2019-12838: Fixed SchedMD Slurm SQL Injection issue (bnc#1140709).
• CVE-2019-19727: Fixed permissions of slurmdbd.conf (bsc#1155784).

Bug fixes:

• Fix ownership of /var/spool/slurm on new installations and upgrade (bsc#1158696).
• Fix %posttrans macro _res_update to cope with added newline (bsc#1153259).
• Move srun from 'slurm' to 'slurm-node': srun is required on the nodes as well so sbatch will work. 'slurm-node' is a requirement when 'slurm' is installed (bsc#1153095).

This update for slurm fixes the following issues:

• CVE-2019-19728: Fixed a privilege escalation with srun (bsc#1159692).

This update for pdsh, slurm_18_08 fixes the following issues:

Slurm was included in the 18.08 release, as 'slurm_18_08' package. The version 18.08.9 contains all recent security fixes, including:

• CVE-2019-19728: Fixed a privilege escalation with srun, where --uid might have unintended side effects (bsc#1159692).
• CVE-2019-19727: Fixed permissions of slurmdbd.conf (bsc#1155784).

pdsh was updated to:

• Add support for an alternative SLURM version when building the slurm plugin.

This update for pdsh, slurm_18_08 fixes the following issues:

Slurm was included in the 18.08 release, as 'slurm_18_08' package. The version 18.08.9 contains all recent security fixes, including:

• CVE-2019-19728: Fixed a privilege escalation with srun, where --uid might have unintended side effects (bsc#1159692).
• CVE-2019-19727: Fixed permissions of slurmdbd.conf (bsc#1155784).

pdsh was updated to:

• Add support for an alternative SLURM version when building the slurm plugin.

This update for pdsh, slurm_20_02 fixes the following issues:

Changes in slurm_20_02:

• Add support for openPMIx also for Leap/SLE 15.0/1 (bsc#1173805).

• Do not run %check on SLE-12-SP2: Some incompatibility in tcl makes this fail.

• Remove unneeded build dependency to postgresql-devel.

• Disable build on s390 (requires 64bit).

• Bring QA to the package build: add %%check stage.

• Remove cruft that isn't needed any longer.

• Add 'ghosted' run-file.

• Add rpmlint filter to handle issues with library packages for Leap and enterprise upgrade versions.

• Updated to 20.02.3 which fixes CVE-2020-12693 (bsc#1172004).

• Other changes are:

• Factor in ntasks-per-core=1 with cons_tres.
• Fix formatting in error message in cons_tres.
• Fix calling stat on a NULL variable.
• Fix minor memory leak when using reservations with flags=first_cores.
• Fix gpu bind issue when CPUs=Cores and ThreadsPerCore > 1 on a node.
• Fix --mem-per-gpu for heterogenous --gres requests.
• Fix slurmctld load order in load_all_part_state().
• Fix race condition not finding jobacct gather task cgroup entry.
• Suppress error message when selecting nodes on disjoint topologies.
• Improve performance of _pack_default_job_details() with large number of job
• arguments.
• Fix archive loading previous to 17.11 jobs per-node req_mem.
• Fix regresion validating that --gpus-per-socket requires --sockets-per-node
• for steps. Should only validate allocation requests.
• error() instead of fatal() when parsing an invalid hostlist.
• nss_slurm - fix potential deadlock in slurmstepd on overloaded systems.
• cons_tres - fix --gres-flags=enforce-binding and related --cpus-per-gres.
• cons_tres - Allocate lowest numbered cores when filtering cores with gres.
• Fix getting system counts for named GRES/TRES.
• MySQL - Fix for handing typed GRES for association rollups.
• Fix step allocations when tasks_per_core > 1.
• Fix allocating more GRES than requested when asking for multiple GRES types.

• Treat libnss_slurm like any other package: add version string to upgrade package.

• Updated to 20.02.1 with following changes'

• Improve job state reason for jobs hitting partition_job_depth.
• Speed up testing of singleton dependencies.
• Fix negative loop bound in cons_tres.
• srun - capture the MPI plugin return code from mpi_hook_client_fini() and use as final return code for step failure.
• Fix segfault in cli_filter/lua.
• Fix --gpu-bind=map_gpu reusability if tasks > elements.
• Make sure config_flags on a gres are sent to the slurmctld on node registration.
• Prolog/Epilog - Fix missing GPU information.
• Fix segfault when using config parser for expanded lines.
• Fix bit overlap test function.
• Don't accrue time if job begin time is in the future.
• Remove accrue time when updating a job start/eligible time to the future.
• Fix regression in 20.02.0 that broke --depend=expand.
• Reset begin time on job release if it's not in the future.
• Fix for recovering burst buffers when using high-availability.
• Fix invalid read due to freeing an incorrectly allocated env array.
• Update slurmctld -i message to warn about losing data.
• Fix scontrol cancel_reboot so it clears the DRAIN flag and node reason for a pending ASAP reboot.

Changes in pdsh:

• Bring QA to the package build: add %%check stage

• Since the build for the SLE-12 HPC Module got fixed, simplify spec file and remove legacy workarounds.

• Remove _multibuild file where not needed.

This update for pdsh fixes the following issues:

• Preparing pdsh for Slurm 20.11 (jsc#ECO-2412)

• Simplify convoluted condition.

  This update for slurm fixes the following issues:

• Fix potential buffer overflows from use of unpackmem(). CVE-2020-27745 (bsc#1178890)

• Fix potential leak of the magic cookie when sent as an argument to the xauth command. CVE-2020-27746 (bsc#1178891)

• Add support for openPMIx also for Leap/SLE 15.0/1 (bsc#1173805).

• Updated to 20.02.3 which fixes CVE-2020-12693 (bsc#1172004).

• slurm-plugins will now also require pmix not only libpmix (bsc#1164326)

• Removed autopatch as it doesn't work for the SLE-11-SP4 build.

• Disable %arm builds as this is no longer supported.

• pmix searches now also for libpmix.so.2 so that there is no dependency for devel package (bsc#1164386)

• Update to version 20.02.0 (jsc#SLE-8491)

  • Fix minor memory leak in slurmd on reconfig.
  • Fix invalid ptr reference when rolling up data in the database.
  • Change shtml2html.py to require python3 for RHEL8 support, and match man2html.py.
  • slurm.spec - override 'hardening' linker flags to ensure RHEL8 builds in a usable manner.
  • Fix type mismatches in the perl API.
  • Prevent use of uninitialized slurmctld_diag_stats.
  • Fixed various Coverity issues.
  • Only show warning about root-less topology in daemons.
  • Fix accounting of jobs in IGNORE_JOBS reservations.
  • Fix issue with batch steps state not loading correctly when upgrading from 19.05.
  • Deprecate max_depend_depth in SchedulerParameters and move it to DependencyParameters.
  • Silence erroneous error on slurmctld upgrade when loading federation state.
  • Break infinite loop in cons_tres dealing with incorrect tasks per tres request resulting in slurmctld hang.
  • Improve handling of --gpus-per-task to make sure appropriate number of GPUs is assigned to job.
  • Fix seg fault on cons_res when requesting --spread-job.

• Move to python3 for everything but SLE-11-SP4

  • For SLE-11-SP4 add a workaround to handle a python3 script (python2.7 compliant).

  • sbatch - fix segfault when no newline at the end of a burst buffer file.

  • Change scancel to only check job's base state when matching -t options.

  • Save job dependency list in state files.

  • cons_tres - allow jobs to be run on systems with root-less topologies.

  • Restore pre-20.02pre1 PrologSlurmctld synchonization behavior to avoid various race conditions, and ensure proper batch job launch.

  • Add new slurmrestd command/daemon which implements the Slurm REST API.

• standard slurm.conf uses now also SlurmctldHost on all build targets (bsc#1162377)

• start slurmdbd after mariadb (bsc#1161716)

• Update to version 19.05.5 (jsc#SLE-8491)

  • Includes security fixes CVE-2019-19727, CVE-2019-19728, CVE-2019-12838.
  • Disable i586 builds as this is no longer supported.
  • Create libnss_slurm package to support user and group resolution thru slurmstepd.

• Update to v18.08.9 for fixing CVE-2019-19728 (bsc#1159692).

  • Make Slurm compile on linux after sys/sysctl.h was deprecated.
  • Install slurmdbd.conf.example with 0600 permissions to encourage secure use. CVE-2019-19727.
  • srun - do not continue with job launch if --uid fails. CVE-2019-19728.

• added pmix support jsc#SLE-10800

• Use --with-shared-libslurm to build slurm binaries using libslurm.

• Make libslurm depend on slurm-config.

• Fix ownership of /var/spool/slurm on new installations and upgrade (bsc#1158696).

• Fix permissions of slurmdbd.conf (bsc#1155784, CVE-2019-19727).

• Fix %posttrans macro _res_update to cope with added newline (bsc#1153259).

• Add package slurm-webdoc which sets up a web server to provide the documentation for the version shipped.

• Move srun from 'slurm' to 'slurm-node': srun is required on the nodes as well so sbatch will work. 'slurm-node' is a requirement when 'slurm' is installed (bsc#1153095).

• Updated to 18.08.8 for fixing (CVE-2019-12838, bsc#1140709,…