Set UsePAM=1 in slurm.conf

Fixes: rarias/jungle#245

flake.nix

@@ -5,14 +5,19 @@
 
   outputs = { self, nixpkgs, ... }:
 let
-  forAllSystems = nixpkgs.lib.genAttrs [ "x86_64-linux" "aarch64-linux" "armv6l-linux" "armv7l-linux" "i686-linux" "riscv64-linux" ];
-
   mkConf = name: nixpkgs.lib.nixosSystem {
     system = "x86_64-linux";
     specialArgs = { inherit nixpkgs; theFlake = self; };
     modules = [ "${self.outPath}/m/${name}/configuration.nix" ];
   };
-  in
+  # For now we only support x86
+  system = "x86_64-linux";
+  pkgs = import nixpkgs {
+    inherit system;
+    overlays = [ self.overlays.default ];
+    config.allowUnfree = true;
+  };
+in
   {
     nixosConfigurations = {
       hut     = mkConf "hut";
@@ -33,15 +38,9 @@ let
     overlays.default = self.bscOverlay;
 
     # full nixpkgs with our overlay applied
-    legacyPackages = forAllSystems (system:
-      import nixpkgs {
-        inherit system;
-        overlays = [ self.overlays.default ];
-        config.allowUnfree = true;
-      }
-    );
+    legacyPackages.${system} = pkgs;
 
-    hydraJobs = self.legacyPackages.x86_64-linux.bsc.hydraJobs;
+    hydraJobs = self.legacyPackages.${system}.bsc.hydraJobs;
 
     # propagate nixpkgs lib, so we can do bscpkgs.lib
     lib = nixpkgs.lib // {

m/module/slurm-common.nix

@@ -54,6 +54,11 @@
       LaunchParameters=use_interactive_step
       SlurmdDebug=debug5
       #DebugFlags=Protocol,Cgroup
+
+      # Follow PAM rules for users requesting access to a node via SLURM, so
+      # that the need to have a local account. Otherwise SLURM only takes into
+      # account the credentials at the login node.
+      UsePAM=1
     '';
 
     extraCgroupConfig = ''

overlay.nix

@@ -61,16 +61,6 @@ let
     tagaspi = callPackage ./pkgs/tagaspi/default.nix { };
     tampi = callPackage ./pkgs/tampi/default.nix { };
     upc-qaire-exporter = prev.callPackage ./pkgs/upc-qaire-exporter/default.nix { };
-    upx = prev.upx.overrideAttrs {
-      version = "5.1.0";
-      src = final.fetchFromGitHub {
-        owner = "upx";
-        repo = "upx";
-        tag = "v5.1.0";
-        fetchSubmodules = true;
-        hash = "sha256-FQtDHsbZ/JrgRLwc2Wd2F5ZcBdqrU0YIT9hGQ0k0D+w=";
-      };
-    };
     wxparaver = callPackage ./pkgs/paraver/default.nix { };
   };
 

pkgs/nix-portable/default.nix

@@ -19,16 +19,6 @@ with builtins;
   compression ? "zstd -19 -T0",
   lib ? pkgs.lib,
   pkgs ? import <nixpkgs> {},
-
-  # pkgs set from the host system (just for eval in installDynamic)
-  pkgsHost ?
-    if stdenv.hostPlatform == stdenv.buildPlatform then
-      pkgs
-    else
-      import pkgs.path {
-        system = pkgs.stdenv.hostPlatform.system;
-      },
-
   # hardcode executable to run. Useful when creating a bundle.
   bundledPackage ? null,
 
@@ -59,7 +49,7 @@ let
     in
     stdenv.mkDerivation {
       name = "nix-portable-store-tarball";
-      nativeBuildInputs = [ perl pkgs.zstd ];
+      nativeBuildInputs = [ perl zstd ];
       exportReferencesGraph = map (x: [("closure-" + baseNameOf x) x]) targets;
       buildCommand = ''
         storePaths=$(cat ${closureInfo}/store-paths)
@@ -96,9 +86,9 @@ let
   '';
 
   installDynamic = pkgname: let
-    out = builtins.unsafeDiscardStringContext pkgsHost.${pkgname}.out.outPath;
+    out = pkgs.${pkgname}.out;
   in ''
-    if [ ! -e \$store${lib.removePrefix "/nix/store" out} ] ; then
+    if [ ! -e \$store${lib.removePrefix "/nix/store" pkgs.${pkgname}.out} ] ; then
       debug "Installing ${pkgname}"
       \$run \$store${lib.removePrefix "/nix/store" nix}/bin/nix build --impure --no-link --expr "
         (import ${nixpkgsSrc} {}).${pkgname}.out
@@ -110,9 +100,7 @@ let
     export PATH="${out}/bin:\$PATH"
   '';
 
-  caBundleZstd = pkgs.runCommand "cacerts" {
-    nativeBuildInputs = [ pkgs.zstd ];
-  } "cat ${cacert}/etc/ssl/certs/ca-bundle.crt | zstd -19 > $out";
+  caBundleZstd = pkgs.runCommand "cacerts" {} "cat ${cacert}/etc/ssl/certs/ca-bundle.crt | ${zstd}/bin/zstd -19 > $out";
 
   bwrap = packStaticBin "${bwrapStatic}/bin/bwrap";
   nixStatic = packStaticBin "${inp.nixStatic}/bin/nix";
@@ -264,7 +252,7 @@ let
     fi
 
     # Override $SHELL with nix bashInteractive
-    export SHELL="${builtins.unsafeDiscardStringContext pkgsHost.bashInteractive.out.outPath}/bin/bash"
+    export SHELL="${pkgs.bashInteractive.out}/bin/bash"
     export PS1="\n\[\033[1;32m\][\[\e]0;\u@\h: \w\a\]\u@\h:\w]\$\[\033[0m\] "
 
     # unset bash function aliases
@@ -309,7 +297,7 @@ let
 
 
     collectBinds(){
-      pathsTopLevel="/boot /run /sys \$PWD /gpfs /tmp /scratch /home"
+      pathsTopLevel="/boot /run /sys \$PWD /gpfs /tmp /scratch"
 
       toBind=""
       for p in \$pathsTopLevel; do
@@ -603,7 +591,7 @@ let
   runtimeScriptEscaped = replaceStrings ["\""] ["\\\""] runtimeScript;
 
   nixPortable = pkgs.runCommand pname {
-    nativeBuildInputs = [unixtools.xxd unzip pkgs.zip];
+    nativeBuildInputs = [unixtools.xxd unzip];
 
     meta = {
       homepage = "https://github.com/DavHau/nix-portable";
@@ -631,7 +619,7 @@ let
 
     unzip -vl $out/bin/nix-portable.zip
 
-    zip="zip -0"
+    zip="${zip}/bin/zip -0"
     $zip $out/bin/nix-portable.zip ${bwrap}/bin/bwrap
     $zip $out/bin/nix-portable.zip ${nixStatic}/bin/nix
     $zip $out/bin/nix-portable.zip ${zstd}/bin/zstd
@@ -642,7 +630,7 @@ let
     fp=$(sha256sum $out/bin/nix-portable.zip | cut -d " "  -f 1)
     sed -i "s/_FINGERPRINT_PLACEHOLDER_/$fp/g" $out/bin/nix-portable.zip
     # fix broken zip header due to manual modification
-    zip -F $out/bin/nix-portable.zip --out $out/bin/nix-portable-fixed.zip
+    ${zip}/bin/zip -F $out/bin/nix-portable.zip --out $out/bin/nix-portable-fixed.zip
 
     rm $out/bin/nix-portable.zip
     executable=${if bundledPackage == null then "" else bundledExe}