Disallow users to remove jobs

[jesse]

Is it possible to stop users from removing jobs from qube?

I created a script to process and purge jobs older than one month.  This has been nice for us since we can now assess total farm usage for jobs that we've had.  Unfortunately the data is not accurate because many jobs are removed before I process them.

[eric]

In order to do it for all Default Users, you'll need to login to your Supervisor and launch the Configuration GUI.
Under Supervisor Settings in the Default User Permissions box, uncheck Remove Job. Closing out the GUI should restart your Supervisor and establish the permission for all users not specifically given permissions.

If you have any such users, you'll need to use the qbusers command found in your $QBDIR/sbin:

    qbusers --delete --remove user user ...

[jesse]

Ok cool.

My supervisor is a headless linux box.  Is there a way to set default permissions without the GUI?  I usually make my changes though an ssh terminal.

Thanks

[eric]

Unfortunately, it's not too easy as you have to add up a bunch of flag mask values.
Can you post your current Default User settings from qbusers --list and I can try to calculate the correct value.

[jesse]

Cool I got it from the docs. 
/etc/qb.conf can receive a bitmasked value setting the default for user security.
supervisor_default_security = 18775

I see that it also seems to allow for either a hexadecimal or decimal number for a value.

Now that I am setting up a default set of permissions, I would like a better description of the following items:
bump
preempt
interrupt
suspend
resume
requeue
migrate
shove
retire

The rest of the items seem to make sense.  It might be good if the docs were eventually fleshed out.

I can guess at what a couple of these mean, but I'd really like to see it written out.

Thanks

[troy]

Hi Jesse,

Almost all of these can be looked up in Appendix "A" of the the User manual (page 67) by putting "qb" in front of them - for example, "preempt" permission is essentially the ability to execute the "qbpreempt" command.

However, "bump" is an exception - this is the ability to execute "qbtop" or "qbbottom" - moving a job to the top/bottom of it's priority (within a given priority, jobs are normally executed in a FIFO order).

"qbshove" was originally an internal debugging tool - it essentially generates an event, that makes the queuing algorithm re-evaluate the state of the listed job ID(s). It has a permission attached to it, because everything gets a permission attached to it, but it doesn't actually "do" anything to the job.