Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Make python venv creation independent from the user #4189

Merged
merged 5 commits into from
May 10, 2024

Conversation

tobim
Copy link
Member

@tobim tobim commented May 6, 2024

A permission error caused python operator to fail when it was previously used by another system user with the same set of requirements.

@tobim tobim added the bug Incorrect behavior label May 6, 2024
@tobim tobim marked this pull request as draft May 6, 2024 10:05
dominiklohmann
dominiklohmann previously approved these changes May 6, 2024
Copy link
Member

@dominiklohmann dominiklohmann left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nice catch! 👀

libtenzir/builtins/operators/python.cpp Show resolved Hide resolved
@tobim
Copy link
Member Author

tobim commented May 7, 2024

I did quite a bit of testing on this and unfortunately the change as proposed so far does not work. The problem is that semaphore creation is subject to the processes umask, which defaults to 022 on most systems. The naive approach would be to temporarily set the umask to 000, but that that is highly unsafe in a multithreaded program.

A complete fix should still be possible by wrapping all the venv creation steps in an extra python subprocess (which would be single threaded) and use that to manage the inter process synchronization. This would have the nice side effect of securing the sync against SIGKILLs, SEGFAULTS, and the like.

@dominiklohmann
Copy link
Member

There's also the option of creating separate cache directories per user.

Copy link
Member

@dominiklohmann dominiklohmann left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the fix!

libtenzir/builtins/operators/python.cpp Outdated Show resolved Hide resolved
changelog/next/bug-fixes/4189--python-permission-issues.md Outdated Show resolved Hide resolved
@dominiklohmann dominiklohmann marked this pull request as ready for review May 10, 2024 10:33
@dominiklohmann dominiklohmann merged commit 9e08bb5 into main May 10, 2024
48 of 51 checks passed
@dominiklohmann dominiklohmann deleted the topic/fix-semaphore-permissions branch May 10, 2024 12:33
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Incorrect behavior
Projects
None yet
3 participants