Mark slurm seff_path as require_trusted_provider (#24235)

* fix(slurm): mark seff_path as require_trusted_provider

The seff binary path is resolved from the seff_path instance config
and used as argv[0] in subprocess.run, but seff_path was never declared
in the config spec, so it had no trusted-provider guard like the other
binary path fields.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* chore(slurm): add changelog entry for seff_path

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* ddev validate models slurm -s

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

Author: NouemanKHAL

slurm/assets/configuration/spec.yaml

@@ -119,6 +119,13 @@ files:
         type: string
         require_trusted_provider: true
         example: /usr/bin/scontrol
+    - name: seff_path
+      description: Full path to the seff binary.
+      fleet_configurable: true
+      value:
+        type: string
+        require_trusted_provider: true
+        example: /usr/bin/seff
     - name: debug_sinfo_stats
       description: |
         Whether or not to enable debug logging for the sinfo command. This logs the output of the sinfo command

slurm/changelog.d/24235.security

@@ -0,0 +1 @@
+Require a trusted provider for the ``seff_path`` config option.

slurm/datadog_checks/slurm/config_models/defaults.py

@@ -96,6 +96,10 @@ def instance_sdiag_path():
     return '/usr/bin/sdiag'
 
 
+def instance_seff_path():
+    return '/usr/bin/seff'
+
+
 def instance_sinfo_collection_level():
     return 1
 

slurm/datadog_checks/slurm/config_models/instance.py

@@ -20,7 +20,7 @@
 
 
 SECURE_FIELD_NAMES = frozenset(
-    ['sacct_path', 'scontrol_path', 'sdiag_path', 'sinfo_path', 'squeue_path', 'sshare_path']
+    ['sacct_path', 'scontrol_path', 'sdiag_path', 'seff_path', 'sinfo_path', 'squeue_path', 'sshare_path']
 )
 
 
@@ -61,6 +61,7 @@ class InstanceConfig(BaseModel):
     sacct_path: Optional[str] = None
     scontrol_path: Optional[str] = None
     sdiag_path: Optional[str] = None
+    seff_path: Optional[str] = None
     service: Optional[str] = None
     sinfo_collection_level: Optional[int] = None
     sinfo_path: Optional[str] = None

slurm/datadog_checks/slurm/data/conf.yaml.example

@@ -99,6 +99,11 @@ instances:
     #
     # scontrol_path: /usr/bin/scontrol
 
+    ## @param seff_path - string - optional - default: /usr/bin/seff
+    ## Full path to the seff binary.
+    #
+    # seff_path: /usr/bin/seff
+
     ## @param tags - list of strings - optional
     ## A list of tags to attach to every metric and service check emitted by this instance.
     ##