IBM Spectrum LSF (job submission, file permissions): Weak file permissions in the LSF install let a local user change

Impact

Weak file permissions in the LSF install let a local user change the user a job is submitted as. On a shared GPU cluster that means running your workload under someone else's identity, charged to their account and with access to their data.

Who can reach it

A local user on an LSF submission host, affecting LSF 9.1.1, 9.1.2, 9.1.3 and 10.1.

What to do

Apply IBM's LSF fix pack and, separately, tighten the permissions on the LSF configuration and binary directories - the underlying issue is filesystem mode, so the correct modes need to be verified after every LSF upgrade, not just once.

References