Merge pull request DIRACGrid#7525 from fstagni/90_fixes3

[9.0] Miscellaneous fixes

SECURITY.md

@@ -4,11 +4,9 @@
 
 | Version | Supported          |
 | ------- | ------------------ |
-| >= 7.1  | :white_check_mark: |
-| < 7.1   | :x:                |
+| >= 8.0  | :white_check_mark: |
+| < 8.0   | :x:                |
 
 ## Reporting a Vulnerability
 
-Please report any suspected vulnerabilities by emailing fstagni-at-cern.ch and atsareg-at-in2p3.fr.
-We will respond to you within 2 working days.
-If for some reason you do not recieve a response, please follow up via email to ensure we received your original message.
+You can privately report vulnerability at https://github.com/DIRACGrid/DIRAC/security

src/DIRAC/WorkloadManagementSystem/DB/SandboxMetadataDB.py

@@ -206,7 +206,7 @@ def assignSandboxesToEntities(self, enDict, requesterName, requesterGroup, owner
 
             if not insertValues:
                 return S_ERROR(
-                    f"Sandbox does not exist or you're not authorized to assign it being {requesterName}@{requesterGroup}"
+                    f"Sandbox does not exist or you are not authorized to assign it being {requesterName}@{requesterGroup}"
                 )
             sqlCmd = f"INSERT INTO `sb_EntityMapping` ( entityId, Type, SBId ) VALUES {', '.join(insertValues)}"
             result = self._update(sqlCmd)

src/DIRAC/WorkloadManagementSystem/JobWrapper/Watchdog.py

@@ -718,6 +718,8 @@ def calibrate(self):
             self.initialValues["RSS"] = result["Value"]
             self.log.verbose("RSS(MB)", f"{result['Value']:.1f}")
         self.parameters["RSS"] = []
+        self.initialValues["MemoryUsed"] = result["Value"]
+        self.parameters["MemoryUsed"] = []
 
         # We exclude fuse so that mountpoints can be cleaned up by automount after a period unused
         # (specific request from CERN batch service).

src/DIRAC/WorkloadManagementSystem/JobWrapper/test/Test_JobWrapper.py

@@ -4,20 +4,18 @@
 import shutil
 import tempfile
 import time
-import pytest
 from unittest.mock import MagicMock
 
-from DIRAC import gLogger
+import pytest
+
 import DIRAC
+from DIRAC import gLogger
 from DIRAC.Core.Utilities import DErrno
-from DIRAC.Core.Utilities.ReturnValues import S_ERROR, S_OK
-
+from DIRAC.Core.Utilities.ReturnValues import S_ERROR
 from DIRAC.DataManagementSystem.Client.test.mock_DM import dm_mock
 from DIRAC.Resources.Catalog.test.mock_FC import fc_mock
-
+from DIRAC.WorkloadManagementSystem.Client import JobMinorStatus, JobStatus
 from DIRAC.WorkloadManagementSystem.JobWrapper.JobWrapper import JobWrapper
-from DIRAC.WorkloadManagementSystem.JobWrapper.Watchdog import Watchdog
-from DIRAC.WorkloadManagementSystem.Client import JobStatus, JobMinorStatus
 
 getSystemSectionMock = MagicMock()
 getSystemSectionMock.return_value = "aValue"
@@ -196,7 +194,7 @@ def test_processSuccessfulCommand(mocker):
     assert result["Value"]["cpuTimeConsumed"][0] > 0
     assert not result["Value"]["watchdogError"]
     assert "LastUpdateCPU(s)" in result["Value"]["watchdogStats"]
-    assert "MemoryUsed(kb)" in result["Value"]["watchdogStats"]
+    assert "MemoryUsed(MB)" in result["Value"]["watchdogStats"]
 
 
 @pytest.mark.slow
@@ -254,7 +252,7 @@ def test_processFailedCommand(mocker):
     assert result["Value"]["cpuTimeConsumed"][0] > 0
     assert not result["Value"]["watchdogError"]
     assert "LastUpdateCPU(s)" in result["Value"]["watchdogStats"]
-    assert "MemoryUsed(kb)" in result["Value"]["watchdogStats"]
+    assert "MemoryUsed(MB)" in result["Value"]["watchdogStats"]
 
 
 @pytest.mark.slow
@@ -357,7 +355,7 @@ def set_param_side_effect(*args, **kwargs):
         "payloadExecutorError": None,
         "cpuTimeConsumed": [100, 200, 300, 400, 500],
         "watchdogError": None,
-        "watchdogStats": {"LastUpdateCPU(s)": "100", "MemoryUsed(kb)": "100"},
+        "watchdogStats": {"LastUpdateCPU(s)": "100", "MemoryUsed(MB)": "100"},
     }
     jw.executionResults["CPU"] = payloadResult["cpuTimeConsumed"]
 
@@ -378,7 +376,7 @@ def set_param_side_effect(*args, **kwargs):
         "payloadExecutorError": None,
         "cpuTimeConsumed": [100, 200, 300, 400, 500],
         "watchdogError": None,
-        "watchdogStats": {"LastUpdateCPU(s)": "100", "MemoryUsed(kb)": "100"},
+        "watchdogStats": {"LastUpdateCPU(s)": "100", "MemoryUsed(MB)": "100"},
     }
     jw.executionResults["CPU"] = payloadResult["cpuTimeConsumed"]
 
@@ -399,7 +397,7 @@ def set_param_side_effect(*args, **kwargs):
         "payloadExecutorError": None,
         "cpuTimeConsumed": [100, 200, 300, 400, 500],
         "watchdogError": None,
-        "watchdogStats": {"LastUpdateCPU(s)": "100", "MemoryUsed(kb)": "100"},
+        "watchdogStats": {"LastUpdateCPU(s)": "100", "MemoryUsed(MB)": "100"},
     }
     jw.executionResults["CPU"] = payloadResult["cpuTimeConsumed"]
 
@@ -422,7 +420,7 @@ def set_param_side_effect(*args, **kwargs):
         "payloadExecutorError": None,
         "cpuTimeConsumed": [100, 200, 300, 400, 500],
         "watchdogError": None,
-        "watchdogStats": {"LastUpdateCPU(s)": "100", "MemoryUsed(kb)": "100"},
+        "watchdogStats": {"LastUpdateCPU(s)": "100", "MemoryUsed(MB)": "100"},
     }
     jw.executionResults["CPU"] = payloadResult["cpuTimeConsumed"]
 
@@ -443,7 +441,7 @@ def set_param_side_effect(*args, **kwargs):
         "payloadExecutorError": None,
         "cpuTimeConsumed": [100, 200, 300, 400, 500],
         "watchdogError": "Watchdog error",
-        "watchdogStats": {"LastUpdateCPU(s)": "100", "MemoryUsed(kb)": "100"},
+        "watchdogStats": {"LastUpdateCPU(s)": "100", "MemoryUsed(MB)": "100"},
     }
     jw.executionResults["CPU"] = payloadResult["cpuTimeConsumed"]
 

tests/CI/docker-compose.yml

@@ -101,7 +101,7 @@ services:
       - DIRACX_CONFIG_BACKEND_URL=git+file:///cs_store/initialRepo
       - DIRACX_SERVICE_AUTH_TOKEN_KEY=file:///signing-key/rs256.key
     pull_policy: always
-    command: ["sleep", "infinity"]
+    command: ["sleep", "infinity"] # This is necessary because of the issue described in https://github.com/moby/moby/issues/42275. What is added here is a hack/workaround.
 
 
   dirac-client:
@@ -114,7 +114,7 @@ services:
     ulimits:
       nofile: 8192
     pull_policy: always
-    command: ["sleep", "infinity"]
+    command: ["sleep", "infinity"] # This is necessary because of the issue described in https://github.com/moby/moby/issues/42275. What is added here is a hack/workaround.
 
   diracx-init-key:
     image: ghcr.io/diracgrid/diracx/secret-generation:latest