<div dir="ltr">I encountered the same problem, and as with munge I created a .te file that can be built to create a policy to add to the compute nodes to fix this:<div><br></div><div>my-pam_slurm_adopt.te:</div><div>-----------------------------------------------------------------------------------</div><div>module my-pam_slurm_adopt 1.0;<br><br>require {<br> type sshd_t;<br> type var_spool_t;<br> class sock_file write;<br>}<br><br>#============= sshd_t ==============<br><br>#!!!! WARNING: 'var_spool_t' is a base type.<br>allow sshd_t var_spool_t:sock_file { write };<br></div><div>-----------------------------------------------------------------------------------</div><div>My notes adapted from a similar module for munge:</div><div><br></div><div><p class="MsoNormal" style="margin:0cm 0cm 8pt;line-height:107%;font-size:11pt;font-family:Calibri,sans-serif">Preparing and compiling the policy requires that the <span style="font-family:"Courier New"">selinux-policy-devel</span> package is
installed; this only has to be done on one server, typically a separate
development node. This from the RHEL docs:</p>
<p class="MsoNormal" style="margin:0cm 0cm 8pt;line-height:107%;font-size:11pt;font-family:Calibri,sans-serif"><i>For developing policy
modules, the selinux-policy-devel package includes all of the interface files
used to build policy. It is recommended that people who build policy use these
files to build the policy modules.</i></p>
<p class="MsoNormal" style="margin:0cm 0cm 8pt;line-height:107%;font-size:11pt;font-family:Calibri,sans-serif"><i>This package installs
the policy interface files under /usr/share/selinux/devel/include and has make
files installed in /usr/share/selinux/devel/Makefile.</i></p>
<p class="MsoNormal" style="margin:0cm 0cm 8pt;line-height:107%;font-size:11pt;font-family:Calibri,sans-serif"><i>To help applications
that need the various SELinux paths, libselinux provides a number of functions
that return the paths to the different configuration files and directories.
This negates the need for applications to hard-code the paths, especially since
the active policy location is dependent on the SELINUXTYPE setting in /etc/selinux/config.</i></p>
<p class="MsoNormal" style="margin:0cm 0cm 8pt;line-height:107%;font-size:11pt"><span style="font-size:11pt"><font face="Calibri, sans-serif">Copy the </font><font face="monospace">my-pam_slurm_adopt.te</font><font face="Calibri, sans-serif"> file into an
empty directory.</font></span><span style="font-family:Calibri,sans-serif;font-size:11pt"> </span><br></p>
<p class="MsoNormal" style="margin:0cm 0cm 8pt;line-height:107%;font-size:11pt;font-family:Calibri,sans-serif">Copy the example Makefile from <span style="font-family:"Courier New"">/usr/share/selinux/devel/Makefile</span> into the same
directory.</p>
<p class="MsoNormal" style="margin:0cm 0cm 8pt;line-height:107%;font-size:11pt;font-family:Calibri,sans-serif">Run <span style="font-family:"Courier New"">make</span> to
create the <span style="font-family:"Courier New"">.pp</span> file.</p>
<p class="MsoNormal" style="margin:0cm 0cm 8pt;line-height:107%;font-size:11pt;font-family:Calibri,sans-serif">Once the <span style="font-family:"Courier New"">my-pam_slurm_adopt.pp</span>
file is created it can be copied to other systems (your compute nodes) and installed using <span style="font-family:"Courier New"">semodule</span> as above. Once it
is built it is worth saving off-host.
Note however that if an update is made to the source it would need to be
recompiled.</p>
<p class="MsoNormal" style="margin:0cm 0cm 8pt;line-height:107%;font-size:11pt;font-family:Calibri,sans-serif">Install the new policy (this will survive reboots):</p>
<p class="MsoNormal" style="margin:0cm 0cm 8pt;line-height:107%;font-size:11pt;font-family:Calibri,sans-serif"><span style="font-size:10pt;line-height:107%;font-family:"Courier New"">/usr/sbin/semodule -i munge.pp</span></p>
<p class="MsoNormal" style="margin:0cm 0cm 8pt;line-height:107%;font-size:11pt;font-family:Calibri,sans-serif"><span style="font-size:10pt;line-height:107%;font-family:"Courier New"">semodule</span> is provided by <span style="font-size:10pt;line-height:107%;font-family:"Courier New"">policycoreutils</span> package, so
install this if it is not already installed:</p>
<p class="MsoNormal" style="margin:0cm 0cm 8pt;line-height:107%;font-size:11pt;font-family:Calibri,sans-serif"><span style="font-size:10pt;line-height:107%;font-family:"Courier New""># yum install policycoreutils</span></p></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Fri, 15 Jan 2021 at 13:47, Ole Holm Nielsen <<a href="mailto:Ole.H.Nielsen@fysik.dtu.dk">Ole.H.Nielsen@fysik.dtu.dk</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">On 10/29/20 12:56 PM, Paul Raines wrote:<br>
> The debugging was useful. The problem turned out to be that I am running<br>
> with SELINUX enabled due to corporate policy. The issue was SELINUX is<br>
> blocking sshd access to /var/slurm/spool/d socket files:<br>
<br>
The documentation <a href="https://slurm.schedmd.com/pam_slurm_adopt.html" rel="noreferrer" target="_blank">https://slurm.schedmd.com/pam_slurm_adopt.html</a> describes <br>
some limitations:<br>
<br>
* SELinux may conflict with pam_slurm_adopt, so it might need to be disabled.<br>
<br>
See also the author's page <a href="http://tech.ryancox.net/2015/11/pamslurmadopt.html" rel="noreferrer" target="_blank">http://tech.ryancox.net/2015/11/pamslurmadopt.html</a><br>
<br>
/Ole<br>
<br>
</blockquote></div>