Secure the cluster from root access for batch interactive jobs in pseudoterminals

Batch interactive jobs in psuedoterminals (that is, jobs submitted using bsub ‑Is and bsub ‑Ip commands) could obtain root privileges to your cluster due to environment variables (LD_PRELOAD and LD_LIBRARY_PATH) contained in the jobs.

To enhance security against users obtaining root privileges using batch interactive jobs in psuedoterminals, enable the cluster remove these environment variables from batch interactive jobs during job initialization. These environment variables are put back before the job runs.

  1. Edit the lsf.conf file.
  2. Enable the cluster to remove the LS_PRELOAD and LD_LIBRARY_PATH environment variables from jobs submitted using bsub ‑Is and bsub ‑Ip commands during job initialization by specifying the LSF_LD_SECURITY parameter.

    LSF_LD_SECURITY=y

  3. Reconfigure LIM and restart mbatchd on the master host to activate these changes.

    lsadmin reconfig

    badmin mdbrestart

In jobs submitted using bsub ‑Is and bsub ‑Ip commands, the LD_PRELOAD and LD_LIBRARY_PATH environment variables are moved to the LSF_LD_PRELOAD and LSF_LD_LIBRARY_PATH environment variables and are moved back before the job runs.