I have a two part question about making our cluster more secure from accidental changes and deletions from running cluster jobs. I don't care about restricting the read or execute permissions of the job, basically I want the job to not be able to delete or change any files outside of its initial directory.
1) Is it possible to chroot a job submitted to sun grid so the job can only write to directory specified when the job is submitted?
2) It is possible to do the above but also allow read-only access to the rest of the system with all paths intact? essentially to have the filesystem appear normal and complete, but the job can only write and delete from the directory it started in.