17.7 Enabling Job Triggers
Context
By default common users cannot create most objects, and as a result, common users also cannot create triggers. The exception, however, is jobs. Because common users can create jobs and triggers generally run as root, additional security is necessary to ensure that not all users can create triggers. For this reason, job triggers are disabled by default.
Because triggers generally run as root, any user given the power to attach triggers has the power to run scripts and commands as root. It is recommended that you only enable job triggers on closed systems in which human users do not have access to directly submit jobs.
To give specific users permission to create job triggers, you must create a QoS, set the trigger flag, and add users to it.
To enable job triggers
- In the
- Add users to the QoS who should be allowed to add triggers to jobs.
QOSCFG[triggerok] QFLAGS=trigger
USERCFG[joe] QDEF=triggerok
User joe is added to the triggerok QoS, giving him both the power to create job triggers and root access to the machine.