Specify working directory of imagebuilder to avoid executing in /tmp - #7515
Merged
Conversation
hanwen-cluster
force-pushed
the
proxy
branch
2 times, most recently
from
July 30, 2026 18:52
42106e3 to
699b311
Compare
hanwen-cluster
commented
Jul 30, 2026
| Cookbook: | ||
| ExtraChefAttributes: | | ||
| {"cluster": {"dcv": {"install_enabled": false}}} | ||
| {% endif %} |
Contributor
Author
There was a problem hiding this comment.
DCV knob is removed because the code is dead
hanwen-cluster
commented
Jul 30, 2026
hgreebe
previously approved these changes
Jul 30, 2026
hanwen-cluster
force-pushed
the
proxy
branch
2 times, most recently
from
August 4, 2026 19:50
81032f4 to
6bd5942
Compare
hanwen-cluster
changed the title
noexec on /tmp for some tests
hanwen-cluster
force-pushed
the
proxy
branch
3 times, most recently
from
August 4, 2026 20:22
aed8e9e to
9e68425
Compare
hanwen-cluster
commented
Aug 4, 2026
hanwen-cluster
force-pushed
the
proxy
branch
4 times, most recently
from
August 5, 2026 18:42
88046b1 to
e2ea64e
Compare
himani2411
reviewed
Aug 5, 2026
| @@ -0,0 +1,288 @@ | |||
| AWSTemplateFormatVersion: 2010-09-09 | |||
Contributor
There was a problem hiding this comment.
Please refrain from using words like hardened, STIG,etc which can cause confusion with the scope of this feature. So I suggest you remove the mention of these words from this PR.
hanwen-cluster
force-pushed
the
proxy
branch
4 times, most recently
from
August 5, 2026 22:08
d946601 to
9f5e5d3
Compare
himani2411
reviewed
Aug 6, 2026
himani2411
previously approved these changes
Aug 6, 2026
1. The ARN of EBS snapshot should't contain account id. 2. The tagging of EBS snapshots inside the Lambda function is not necessary because imagebuilder propagates the tags to snapshots
This commit also set `noexec` on `/tmp` for some tests to monitor ParallelCluster compliance of `noexec` on `/tmp`: 1. test_essential_features: now `noexec` is set on `/tmp` by default. This commit fixes the `gpu_job.sh` to not execute on `/tmp` 2. test_multiple_nics: now `noexec` is set on `/tmp` by default. This test is added because multi-nics configuration script was executed in `/tmp` before pcluster 3.16.0 3. test_build_image: If the test is run on a non-GPU instance, where Nvidia is not installed, create a custom AMI with `noexec` persisted on `/tmp` and run `build-image` on top of this custom AMI. Using the custom AMI has better coverage than (1) and (2), because the `noexec` persisted on `/tmp` in the custom AMI covers the whole workflow of `build-image` and `create-cluster`.
gmarciani
reviewed
Aug 7, 2026
| WorkingDirectory: /opt/parallelcluster/tmp | ||
| Components: | ||
| - ComponentArn: !Ref PatchComponent | ||
| - ComponentArn: !If [BuildNoExecTmpImage, !Ref NoExecTmpComponent, !Ref PatchComponent] |
Contributor
There was a problem hiding this comment.
Why do we need a separate gate? Can;t we just go with a patch component that does not make use of exec in tmp?
Contributor
Author
There was a problem hiding this comment.
This template is reused for two purposes. One is to create an patched AMI, the other one is to create an AMI with noexec on tmp. Depending on the input parameters, we choose one component
| DevSettings: | ||
| EfaInterfaceType: efa | ||
| Cookbook: | ||
| ExtraChefAttributes: '{"cluster": {"tmp_noexec": "true"}}' No newline at end of file |
Contributor
There was a problem hiding this comment.
future improvement: we can make this a test flag thta is injected via test config rather than hard wiring
gmarciani
approved these changes
Aug 7, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description of changes
noexecon/tmpSee commits descriptions for details
Tests
The following tests have passed
References
Checklist
developadd the branch name as prefix in the PR title (e.g.[release-3.6]).Please review the guidelines for contributing and Pull Request Instructions.
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.