(Click to open topic with navigation)

17.0 Object triggers > How-to's > Enabling job triggers

Conventions

17.6 Enabling job triggers

ClosedContext

By default common users cannot create most objects, and as a result, common users also cannot create triggers. The exception, however, is jobs. Because common users can create jobs and triggers generally run as root, additional security is necessary to ensure that not all users can create triggers. For this reason, job triggers are disabled by default.

Because triggers generally run as root, any user given the power to attach triggers has the power to run scripts and commands as root. It is recommended that you only enable job triggers on closed systems in which human users do not have access to directly submit jobs.

To give specific users permission to create job triggers, you must create a QoS, set the trigger flag, and add users to it.

To enable job triggers

  1. In the moab.cfg file, create a QoS and set the trigger flag.

    2. QOSCFG[triggerok]   QFLAGS=trigger

  2. Add users to the QoS who should be allowed to add triggers to jobs.

    3. USERCFG[joe]        QDEF=triggerok

    User joe is added to the triggerok QoS, giving him both the power to create job triggers and root access to the machine.