From ffc26d5dddb60f0920b8dd696d20ce3b26943050 Mon Sep 17 00:00:00 2001 From: M Bernt Date: Thu, 13 Oct 2022 13:53:06 +0200 Subject: [PATCH] Update doc/source/admin/security.md Co-authored-by: Marius van den Beek --- doc/source/admin/security.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/doc/source/admin/security.md b/doc/source/admin/security.md index 00c9d56e178..3ff8aad21f9 100644 --- a/doc/source/admin/security.md +++ b/doc/source/admin/security.md @@ -20,6 +20,6 @@ There are three approaches to protect Galaxy against these risks: - Configure Galaxy to run jobs in a container and enable ``outputs_to_working_directory``. Then the tool will execute in an environment that allows write access only for the job working dir. All other paths will be accessible read only. - Use [Pulsar](https://pulsar.readthedocs.io/) to stage inputs and outputs. -- If containers and Pulsar are not an option, it is possible to use different credentials for running tools. This can be configured using the ``real_system_username`` config variable. Note that this implies ``outputs_to_working_directory``. Furthermore, check that files in directories like ``file_path`` and ``tool_data_path`` are writable only by the user running Galaxy. +- If containers and Pulsar are not an option, it is possible to use different credentials for running tools. This can be configured using the ``real_system_username`` config variable. Note that you also need to enable ``outputs_to_working_directory`` when enabling ``real_system_username``. Furthermore, check that files in directories like ``file_path`` and ``tool_data_path`` are writable only by the user running Galaxy. More information on pulsar configuration can be found in the [job configuration](jobs.md) documentation, and the other two are explained in [using a compute cluster](cluster.md).