From 2c919f6c75413b5a88da7098a54549bfa2dbf8a0 Mon Sep 17 00:00:00 2001 From: Mats Rynge Date: Thu, 29 Oct 2026 06:45:32 -0700 Subject: [PATCH 1/3] Bind passwd for HTCondor containers under cvmfsexec --- 10-setup-htcondor.sh | 11 +++++++++++ sbin/entrypoint.sh | 1 + tests/test_inside_gha.sh | 13 +++++++++++++ 3 files changed, 25 insertions(+) diff --git a/10-setup-htcondor.sh b/10-setup-htcondor.sh index 55919b4..24c4f1f 100755 --- a/10-setup-htcondor.sh +++ b/10-setup-htcondor.sh @@ -627,6 +627,17 @@ do done <$condor_vars_file set -x +# osg-flock's additional-htcondor-config only adds directories from +# GLIDEIN_SINGULARITY_BINDPATH to SINGULARITY_BIND_EXPR. Its file check drops +# /etc/passwd, which the native HTCondor container path also needs when +# cvmfsexec created a nested user namespace. The GlideinWMS wrapper reads +# GLIDEIN_SINGULARITY_BINDPATH directly and already receives this bind. +if [[ $CVMFSEXEC_PASSWD_BIND == 1 ]]; then + singularity_bind_expr=${SINGULARITY_BIND_EXPR#\"} + singularity_bind_expr=${singularity_bind_expr%\"} + echo "SINGULARITY_BIND_EXPR = \"${singularity_bind_expr},/etc/passwd\"" >> "$PILOT_CONFIG_FILE" +fi + if [[ $EXTRA_JOB_ENV ]]; then job_env="$job_env $EXTRA_JOB_ENV" fi diff --git a/sbin/entrypoint.sh b/sbin/entrypoint.sh index 97b84dd..2595a85 100755 --- a/sbin/entrypoint.sh +++ b/sbin/entrypoint.sh @@ -89,6 +89,7 @@ CVMFSEXEC_REPOS=$(tr -d '"'"'" <<<$CVMFSEXEC_REPOS) # delete single and double # lookup. This replaces the job image's own /etc/passwd, so it only runs # when cvmfsexec is actually creating that nested namespace. export SINGULARITY_BIND_EXTRA="${SINGULARITY_BIND_EXTRA:+$SINGULARITY_BIND_EXTRA,}/etc/passwd" +export CVMFSEXEC_PASSWD_BIND=1 cd "$cvmfsexec_root" || \ fail "Couldn't enter $cvmfsexec_root" diff --git a/tests/test_inside_gha.sh b/tests/test_inside_gha.sh index b5c283c..c4a6b86 100755 --- a/tests/test_inside_gha.sh +++ b/tests/test_inside_gha.sh @@ -192,6 +192,18 @@ function test_docker_HAS_SINGULARITY { return 1 } +function test_docker_passwd_bind { + [[ $CVMFS_INSTALL == cvmfsexec ]] || return 0 + print_test_header "Testing HTCondor passwd bind under cvmfsexec" + + local binds + binds=$(run_inside_backfill_container condor_config_val SINGULARITY_BIND_EXPR) || return $? + if [[ ,$binds, != *,/etc/passwd,* ]]; then + echo "HTCondor SINGULARITY_BIND_EXPR omits /etc/passwd: $binds" >&2 + return 1 + fi +} + function test_singularity_startup { print_test_header "Testing container startup" @@ -402,6 +414,7 @@ elif [[ $TESTTYPE == pilot ]]; then start_docker_backfill "${DOCKER_EXTRA_ARGS[@]}" || docker_exit_with_cleanup $? test_docker_startup || docker_exit_with_cleanup $? test_docker_HAS_SINGULARITY || docker_exit_with_cleanup $? + test_docker_passwd_bind || docker_exit_with_cleanup $? docker stop backfill docker_exit_with_cleanup 0 ;; From e9a295c2c124c0bc9ceb43c2b6369372ca7753ab Mon Sep 17 00:00:00 2001 From: Mats Rynge Date: Thu, 29 Oct 2026 07:05:37 -0700 Subject: [PATCH 2/3] Make pilot bind test query generated config --- tests/test_inside_gha.sh | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/tests/test_inside_gha.sh b/tests/test_inside_gha.sh index c4a6b86..8a3bdac 100755 --- a/tests/test_inside_gha.sh +++ b/tests/test_inside_gha.sh @@ -2,7 +2,7 @@ # shellcheck disable=SC2086 APPTAINER_BIN=/usr/bin/apptainer -OSP_TOKEN_PATH=/tmp/token +OSP_TOKEN_PATH=${OSP_TOKEN_PATH:-/tmp/token} CONDOR_LOGDIR=/pilot/log COMMON_APPTAINER_EXEC_ARGS="-B /cvmfs -B /dev/fuse -c -i" COMMON_DOCKER_RUN_ARGS="--user osg @@ -102,7 +102,7 @@ function docker_exit_with_cleanup { function print_test_header { msg=$* - sep=$(python -c "print ('=' * ${#msg})") + sep=$(python3 -c "print ('=' * ${#msg})") echo -e "$sep\n$msg\n$sep" } @@ -197,7 +197,13 @@ function test_docker_passwd_bind { print_test_header "Testing HTCondor passwd bind under cvmfsexec" local binds - binds=$(run_inside_backfill_container condor_config_val SINGULARITY_BIND_EXPR) || return $? + binds=$(run_inside_backfill_container /bin/bash -c ' + PILOT_CONFIG_FILE=$(find /pilot -maxdepth 2 -name condor_config.pilot -print -quit) + export PILOT_CONFIG_FILE + condor_config_val SINGULARITY_BIND_EXPR + ') || return $? + binds=${binds#\"} + binds=${binds%\"} if [[ ,$binds, != *,/etc/passwd,* ]]; then echo "HTCondor SINGULARITY_BIND_EXPR omits /etc/passwd: $binds" >&2 return 1 From 07d17825f1eafa2a88fc00638946f8808472cce2 Mon Sep 17 00:00:00 2001 From: Mats Rynge Date: Thu, 29 Oct 2026 07:58:46 -0700 Subject: [PATCH 3/3] Update tests/test_inside_gha.sh Co-authored-by: Matyas Selmeci --- tests/test_inside_gha.sh | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/tests/test_inside_gha.sh b/tests/test_inside_gha.sh index 8a3bdac..403e823 100755 --- a/tests/test_inside_gha.sh +++ b/tests/test_inside_gha.sh @@ -102,7 +102,8 @@ function docker_exit_with_cleanup { function print_test_header { msg=$* - sep=$(python3 -c "print ('=' * ${#msg})") + printf -v sep '%*s' "${msg}" '' + sep=${sep// /=} echo -e "$sep\n$msg\n$sep" }