Slurm (openSUSE slurm-testsuite packaging): The openSUSE slurm testsuite package ships files with permissive default

Impact

The openSUSE slurm testsuite package ships files with permissive default ownership, so an attacker who already controls the slurm service account can pivot to root on that host. Since slurmctld runs as SlurmUser, a compromise of the controller daemon becomes a compromise of the controller machine.

Who can reach it

Local, requires already having control of the slurm user - so it is a privilege-escalation chain step after a slurmctld or slurmd compromise, not an entry point.

What to do

Only affects hosts where the openSUSE or SLES slurm-testsuite package is installed. Uninstall it from production controllers - a test suite has no business on a scheduler that runs tenant workloads - or update to the fixed package.

References