Managing Cluster User Groups

Users on the Longleaf and Sycamore clusters can be affiliated with a PI, faculty member, institution or work unit in two ways:

• groups that manage/influence SLURM job submission (e.g., rc_piname_pi)
• groups that control access to shared file spaces (e.g., rc_pilab_psx)

Cluster user groups

Shared file space groups

Determining permissions on shared spaces

Slurm user groups

SLURM users are members of at least one group -- known as accounts in SLURM. Generally, when a user requests an account on a cluster, they specify the name of a faculty member with whom to be affiliated.

Membership in these Slurm groups DOES NOT control or grant access to any shared file spaces; these groups affiliate the user with a group's Slurm record keeping and job resources. These groups have a _pi suffix.

To view a PI's Slurm user group's membership, use the sacctmgr command:

$ sacctmgr show associations where account=rc_piname_pi format=user%20,account%20
                User              Account
-------------------- --------------------
                              rc_piname_pi
              user1          rc_piname_pi
              user2          rc_piname_pi

PI's are notified by email when a user requests their jobs to be affiliated with said PI. To request additions to, or deletions from an access group please email research@unc.edu

Slurm shared lab space groups

Shared file space for labs, certain high-level projects and PIs are often located in the /proj mount (e.g., /proj/pinamelab). Access is restricted, and controlled through user membership in a group named with a _psx suffix (e.g., rc_pinamelab_psx).

$ getent group rc_pinamelab_psx
rc_pinamelab_psx:*:5555:user1,user2

Membership in these access groups requires permission from the PI or entity head. To request additions to, or deletions from an access group please email research@unc.edu

Determining permissions on shared spaces

Checking and maintaining appropriate permissions on shared file spaces is the responsibilty of the PI. A PI or person designated by the PI can check directory permissions at the command line. For example

$ ls -la /proj/pinamelab
total 200
drwxrwsr-t   4 piname rc_pinamelab_psx    49 May 10  2018 .
drwxr-xr-x 649 root    root           17116 Jun  3 14:01 ..
drwxrwsr-t  36 piname rc_pinamelab_psx  1661 Jun  4 10:03 projects
drwxrwsr-t   4 piname rc_pinamelab_psx    50 Jan 10  2024 users

In this case, the PI's shared lab space access is limited to members of rc_pinamelab_psx, although other cluster users can list directory contents. The subdirectories projects and users can be further restricted to individual users or sub-groups as appropriate.

See also: https://help.rc.unc.edu/accounts-and-groups