Slurm Credential Plugin Programmer Guide

Overview

This document describe. Slurm credential plugins and the API that defines them. It is intended as a resource to programmers wishing to write their own Slurm credential plugins.

Slurm credential plugins are Slurm plugins that implement a digital signature mechanism. The slurmctld daemon generates a job step credential, signs it, and transmits it to an srun program. The srun program then transmits it to the slurmd daemons directly. The slurmctld daemon does not communicate directly with the slurmd daemons at this time for performance reasons, but the job step credential must be validated by the slurmd daemon as being generated by the slurmctld daemon. Digital signatures provide this validation mechanism. The plugins must conform to the Slurm Plugin API with the following specifications:

const char plugin_type[]
The major type must be "cred." The minor type can be any recognizable abbreviation for the type of credential mechanism. We recommend, for example:

• munge — LLNL's Munge system.

const char plugin_name[]
Some descriptive name for the plugin. There is no requirement with respect to its format.

const uint32_t plugin_version
If specified, identifies the version of Slurm used to build this plugin and any attempt to load the plugin from a different version of Slurm will result in an error. If not specified, then the plugin may be loaded by Slurm commands and daemons from any version, however this may result in difficult to diagnose failures due to changes in the arguments to plugin functions or changes in other Slurm functions used by the plugin.

Data Objects

The implementation must maintain (though not necessarily directly export) an enumerated errno to allow Slurm to discover as practically as possible the reason for any failed API call. Plugin-specific enumerated integer values may be used when appropriate.

These values must not be used as return values in integer-valued functions in the API. The proper error return value from integer-valued functions is SLURM_ERROR. The implementation should endeavor to provide useful and pertinent information by whatever means is practical. Successful API calls are not required to reset any errno to a known value. However, the initial value of any errno, prior to any error condition arising, should be SLURM_SUCCESS.

API Functions

The following functions must appear. Functions which are not implemented should be stubbed.

int init (void)

Description:
Called when the plugin is loaded, before any other functions are called. Put global initialization here.

Returns:
SLURM_SUCCESS on success, or
SLURM_ERROR on failure.

void fini (void)

Description:
Called when the plugin is removed. Clear any allocated storage here.

Returns: None.

Note: These init and fini functions are not the same as those described in the dlopen (3) system library. The C run-time system co-opts those symbols for its own initialization. The system _init() is called before the Slurm init(), and the Slurm fini() is called before the system's _fini().

void *cred_read_private_key(const char *path);

Description: Generate a private key based upon the contents of the supplied file.

Argument:path    (input) fully-qualified pathname to the private key as specified by the JobCredentialPrivateKey configuration parameter.

Returns: The pointer to a key on success or NULL on failure. Call cred_p_destroy_key() to release memory associated with this key.

void *cred_p_read_public_key(const char *path);

Description: Generate a public key based upon the contents of the supplied file.

Argument:path    (input) fully-qualified pathname to the public key as specified by the JobCredentialPublicCertificate configuration parameter.

Returns: The pointer to a key on success or NULL on failure. Call cred_p_destroy_key() to release memory associated with this key.

void cred_p_destroy_key(void *key);

Description: Release storage for a public or private key.

Argument: key    (input/output) pointer to the key previously allocated by cred_p_read_private_key() or cred_p_read_public_key().

char *cred_p_str_error(void);

Description: Return a string describing the last error generated by the credential software.

Returns: A pointer to a string.

int cred_p_sign(void *key, char *buffer, int buf_size, char **sig_pp, unsigned int *sig_size_p);

Description: Generate a signature for the supplied buffer.

Arguments:
key    (input) pointer to the key previously generated by cred_p_read_private_key() or cred_p_read_public_key().
buffer    (input) data to be signed.
buf_size    (input) size of buffer, in bytes.
sig_pp    (input/output) Location in which to store the signature. NOTE: The storage for sig_pp should be allocated using xmalloc() and will be freed by the caller using xfree().
sig_size_p    (input/output) Location in which to store the size of the signature (sig_pp).

Returns: SLURM_SUCCESS if successful. On failure, the plugin should return SLURM_ERROR and set the errno to an appropriate value to indicate the reason for failure.

int cred_p_verify_sign(void *key, char *buffer, int buf_size, char *signature, unsigned int sig_size);

Description: Generate a signature for the supplied buffer.

Arguments:
key    (input) pointer to the key previously generated by cred_p_read_private_key() or cred_p_read_public_key().
buffer    (input) data previously signed by cred_p_sign().
buf_size    (input) size of buffer, in bytes.
signature    (input) Signature as returned in sig_pp by the cred_p_sign() function and to be confirmed.
sig_size    (input) Size of the signature as returned in sig_size_p by cred_p_sign().

Returns: SLURM_SUCCESS if successful. On failure, the plugin should return SLURM_ERROR and set the errno to an appropriate value to indicate the reason for failure.

Last modified 7 January 2019