feat: more robust Linux cross-user cancelation under low memory conditions

[jusiskin]

What was the problem/requirement? (What/Why)

Under low memory situations on Linux, the worker agent can fail to cancel a running session action.

On Linux, processes can only send signals to other processes if at least one of the following are true:

• the target process is owned by the same OS user as the signalling process OR
• if the process sending the signal
  • is root
  • has the CAP_KILL capability (seecapabilities(7) man page)

To overcome this limitation, openjd-sessions used sudo to create a bash process as the target user which then sends the OS signal. When the system has low memory, there may not be sufficient memory to create the subprocesses successfully.

What was the solution? (How)

OpenJobDescription/openjd-sessions-for-python#196 is a work-in-progress enhancement to leverage CAP_KILL and send signals to cross-user processes without creating subprocesses.

This PR builds on this support for CAP_KILL so the worker agent directly signals cross-user processes.

1. The code for install-deadline-worker was modified to configure the worker agent systemd unit with the CAP_KILL ambient capability. This has the effect of adding CAP_KILL to the worker agent process' permitted/effective/inheritable capability sets.
2. The worker agent now drops CAP_KILL from the inheritable capability set early in the program startup so that other threads and subprocesses will not inherit this privileged capability.
3. The openjd-session change takes care of the rest and handles direct signalling for cross-user processes.

What is the impact of this change?

This change allows the worker agent to cancel session actions more robustly in low-memory situations.

How was this change tested?

The cross-user direct signal cancelation tests live in openjd-sessions, but a security end-to-end test was added to ensure that session actions are not able to signal other processes.

Was this change documented?

No

Is this a breaking change?

No

---

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

[ddneilson]

Oh, also, the README should probably be updated to list the (optional) dependency on libcap.so on linux

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[ddneilson]

Thanks for taking this on, Josh. Looks great!