Please update Jupyterlab permissions

ncarr · September 27, 2024, 4:48pm

What type of hardware are you using: Old laptop or computer
What YunoHost version are you running: 11.2.30.2
What app is this about: Jupyterlab

Describe your issue

Hi.
After updating the permissions of the app got jammed and I couldn’t start a jupyter server anymore.
I did some research and I found out that the owner of the folder /opt/jupyterlab is the jupyterlab user and jupyterlab group. BUT it seems that upon starting a server, it uses specific user account (for me nicolas).
I needed to change the owner of the folder to nicolas so that the user nicolas can spawn a server. However I wasn’t able to find an alternative for multiple users.

Please this app need some love. I’m daily driving it and it is a pain to change the owner after each and every update.

Share relevant logs or error messages

Error 500: Internal Server Error

Unhandled error starting server nicolas

tituspijean · September 28, 2024, 1:04am

Hi,

jupyterlab_ynh/conf/systemd.service at 912281bc9d698f459e46be6afb02e6f6cb7967f3 · YunoHost-Apps/jupyterlab_ynh · GitHub tells me that is not the case. Can you provide the Jupyterlab service logs?

ncarr · September 29, 2024, 7:26am

Hi ! Here is a copy of a log that I saved

May 01 15:29:14 yunohost jupyterhub[3035951]: [I 2024-05-01 15:29:14.383 JupyterHub spawner:1692] Spawning jupyterhub-singleuser --config=/opt/jupyterlab/config/jupyter_notebook_config.py
May 01 15:29:14 yunohost jupyterhub[3038374]: Failed to set groups [Errno 22] Invalid argument
May 01 15:29:14 yunohost jupyterhub[3035951]: [E 2024-05-01 15:29:14.390 JupyterHub spawner:1706] Permission denied trying to run '/opt/jupyterlab/venv/bin/jupyterhub-singleuser'. Does user have access to this file?
May 01 15:29:14 yunohost jupyterhub[3035951]: [E 2024-05-01 15:29:14.390 JupyterHub user:887] Unhandled error starting user's server: [Errno 13] Permission denied: 'jupyterhub-singleuser'
May 01 15:29:14 yunohost jupyterhub[3035951]:     Traceback (most recent call last):
May 01 15:29:14 yunohost jupyterhub[3035951]:       File "/opt/jupyterlab/venv/lib/python3.9/site-packages/jupyterhub/user.py", line 801, in spawn
May 01 15:29:14 yunohost jupyterhub[3035951]:         url = await gen.with_timeout(timedelta(seconds=spawner.start_timeout), f)
May 01 15:29:14 yunohost jupyterhub[3035951]:       File "/opt/jupyterlab/venv/lib/python3.9/site-packages/jupyterhub/spawner.py", line 1702, in start
May 01 15:29:14 yunohost jupyterhub[3035951]:         self.proc = Popen(cmd, **popen_kwargs)
May 01 15:29:14 yunohost jupyterhub[3035951]:       File "/usr/lib/python3.9/subprocess.py", line 951, in __init__
May 01 15:29:14 yunohost jupyterhub[3035951]:         self._execute_child(args, executable, preexec_fn, close_fds,
May 01 15:29:14 yunohost jupyterhub[3035951]:       File "/usr/lib/python3.9/subprocess.py", line 1823, in _execute_child
May 01 15:29:14 yunohost jupyterhub[3035951]:         raise child_exception_type(errno_num, err_msg, err_filename)
May 01 15:29:14 yunohost jupyterhub[3035951]:     PermissionError: [Errno 13] Permission denied: 'jupyterhub-singleuser'
May 01 15:29:14 yunohost jupyterhub[3035951]:     
May 01 15:29:14 yunohost jupyterhub[3035951]: [E 2024-05-01 15:29:14.406 JupyterHub web:1875] Uncaught exception POST /jupyterlab/hub/api/users/user/servers/?_xsrf=MnwxOjB8MTA6MTcxNDU3NjAzNnw1Ol94c3JmfDg4Ok1HWmhNalJqWW1NNFptTXhORFV3WW1Ka1l6SmpabVF5T0dWaE9UYzRZV1U2TnpJNE5XTXlZbVk1WmprME5ERTVOR0l4WWpFM016bGxabVUyWmpVeE1UYz18OWFkYWMxMWEzM2E1ODRjMmViMWFjZmE0NDkwYzZhODNkOTZlZmNmNTA5OTBjOTkwYjI0ZTg3OWNlZmE0ZDFjMQ (2a01:e0a:e09:3260::7954:2aa5)
May 01 15:29:14 yunohost jupyterhub[3035951]:     HTTPServerRequest(protocol='http', host='jupyter.my-domain', method='POST', uri='/jupyterlab/hub/api/users/user/servers/?_xsrf=MnwxOjB8MTA6MTcxNDU3NjAzNnw1Ol94c3JmfDg4Ok1HWmhNalJqWW1NNFptTXhORFV3WW1Ka1l6SmpabVF5T0dWaE9UYzRZV1U2TnpJNE5XTXlZbVk1WmprME5ERTVOR0l4WWpFM016bGxabVUyWmpVeE1UYz18OWFkYWMxMWEzM2E1ODRjMmViMWFjZmE0NDkwYzZhODNkOTZlZmNmNTA5OTBjOTkwYjI0ZTg3OWNlZmE0ZDFjMQ', version='HTTP/1.1', remote_ip='2a01:e0a:e09:3260::7954:2aa5')
May 01 15:29:14 yunohost jupyterhub[3035951]:     Traceback (most recent call last):
May 01 15:29:14 yunohost jupyterhub[3035951]:       File "/opt/jupyterlab/venv/lib/python3.9/site-packages/tornado/web.py", line 1790, in _execute
May 01 15:29:14 yunohost jupyterhub[3035951]:         result = await result
May 01 15:29:14 yunohost jupyterhub[3035951]:       File "/opt/jupyterlab/venv/lib/python3.9/site-packages/jupyterhub/apihandlers/users.py", line 566, in post
May 01 15:29:14 yunohost jupyterhub[3035951]:         await self.spawn_single_user(user, server_name, options=options)
May 01 15:29:14 yunohost jupyterhub[3035951]:       File "/opt/jupyterlab/venv/lib/python3.9/site-packages/jupyterhub/handlers/base.py", line 1178, in spawn_single_user
May 01 15:29:14 yunohost jupyterhub[3035951]:         await gen.with_timeout(
May 01 15:29:14 yunohost jupyterhub[3035951]:       File "/opt/jupyterlab/venv/lib/python3.9/site-packages/jupyterhub/handlers/base.py", line 1088, in finish_user_spawn
May 01 15:29:14 yunohost jupyterhub[3035951]:         await spawn_future
May 01 15:29:14 yunohost jupyterhub[3035951]:       File "/opt/jupyterlab/venv/lib/python3.9/site-packages/jupyterhub/user.py", line 905, in spawn
May 01 15:29:14 yunohost jupyterhub[3035951]:         raise e
May 01 15:29:14 yunohost jupyterhub[3035951]:       File "/opt/jupyterlab/venv/lib/python3.9/site-packages/jupyterhub/user.py", line 801, in spawn
May 01 15:29:14 yunohost jupyterhub[3035951]:         url = await gen.with_timeout(timedelta(seconds=spawner.start_timeout), f)
May 01 15:29:14 yunohost jupyterhub[3035951]:       File "/opt/jupyterlab/venv/lib/python3.9/site-packages/jupyterhub/spawner.py", line 1702, in start
May 01 15:29:14 yunohost jupyterhub[3035951]:         self.proc = Popen(cmd, **popen_kwargs)
May 01 15:29:14 yunohost jupyterhub[3035951]:       File "/usr/lib/python3.9/subprocess.py", line 951, in __init__
May 01 15:29:14 yunohost jupyterhub[3035951]:         self._execute_child(args, executable, preexec_fn, close_fds,
May 01 15:29:14 yunohost jupyterhub[3035951]:       File "/usr/lib/python3.9/subprocess.py", line 1823, in _execute_child
May 01 15:29:14 yunohost jupyterhub[3035951]:         raise child_exception_type(errno_num, err_msg, err_filename)
May 01 15:29:14 yunohost jupyterhub[3035951]:     PermissionError: [Errno 13] Permission denied: 'jupyterhub-singleuser'
May 01 15:29:14 yunohost jupyterhub[3035951]:     
May 01 15:29:14 yunohost jupyterhub[3035951]: [E 2024-05-01 15:29:14.407 JupyterHub log:184] {
May 01 15:29:14 yunohost jupyterhub[3035951]:       "X-Forwarded-Port": "80",
May 01 15:29:14 yunohost jupyterhub[3035951]:       "Auth-User": "user",
May 01 15:29:14 yunohost jupyterhub[3035951]:       "Name": "user name",
May 01 15:29:14 yunohost jupyterhub[3035951]:       "Email": "user@my-domain",
May 01 15:29:14 yunohost jupyterhub[3035951]:       "Remote-User": "user",
May 01 15:29:14 yunohost jupyterhub[3035951]:       "Authorization": "Basic [secret]",
May 01 15:29:14 yunohost jupyterhub[3035951]:       "Cookie": "jupyterhub-hub-login=[secret]; _xsrf=[secret]; jupyterhub-session-id=[secret]; SSOwAuthUser=[secret]; SSOwAuthHash=[secret]; SSOwAuthExpire=[secret]",
May 01 15:29:14 yunohost jupyterhub[3035951]:       "Priority": "u=1, i",
May 01 15:29:14 yunohost jupyterhub[3035951]:       "Accept-Language": "fr-FR,fr;q=0.9,en-US;q=0.8,en;q=0.7",
May 01 15:29:14 yunohost jupyterhub[3035951]:       "Referer": "https://jupyter.my-domain/jupyterlab/hub/admin",
May 01 15:29:14 yunohost jupyterhub[3035951]:       "Sec-Fetch-Dest": "empty",
May 01 15:29:14 yunohost jupyterhub[3035951]:       "Sec-Fetch-Mode": "cors",
May 01 15:29:14 yunohost jupyterhub[3035951]:       "Sec-Fetch-Site": "same-origin",
May 01 15:29:14 yunohost jupyterhub[3035951]:       "Origin": "https://jupyter.my-domain",
May 01 15:29:14 yunohost jupyterhub[3035951]:       "Sec-Ch-Ua-Platform": "\"Linux\"",
May 01 15:29:14 yunohost jupyterhub[3035951]:       "User-Agent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36",
May 01 15:29:14 yunohost jupyterhub[3035951]:       "Sec-Ch-Ua-Mobile": "?0",
May 01 15:29:14 yunohost jupyterhub[3035951]:       "Content-Type": "application/json",
May 01 15:29:14 yunohost jupyterhub[3035951]:       "Accept": "application/jupyterhub-pagination+json",
May 01 15:29:14 yunohost jupyterhub[3035951]:       "Sec-Ch-Ua": "\"Not-A.Brand\";v=\"99\", \"Chromium\";v=\"124\"",
May 01 15:29:14 yunohost jupyterhub[3035951]:       "Content-Length": "0",
May 01 15:29:14 yunohost jupyterhub[3035951]:       "Connection": "upgrade",
May 01 15:29:14 yunohost jupyterhub[3035951]:       "X-Forwarded-Host": "jupyter.my-domain",
May 01 15:29:14 yunohost jupyterhub[3035951]:       "X-Forwarded-For": "2a01:e0a:e09:3260::7954:2aa5,::ffff:127.0.0.1",
May 01 15:29:14 yunohost jupyterhub[3035951]:       "X-Forwarded-Proto": "https,http",
May 01 15:29:14 yunohost jupyterhub[3035951]:       "X-Real-Ip": "2a01:e0a:e09:3260::7954:2aa5",
May 01 15:29:14 yunohost jupyterhub[3035951]:       "Host": "jupyter.my-domain"
May 01 15:29:14 yunohost jupyterhub[3035951]:     }```

tituspijean · September 29, 2024, 12:51pm

Thank you for the log. So, indeed, a dedicated server is spawned with the user’s rights when they log in. If they do not have the rights to access JupyerLab’s directory, then you get the current error.

The issue appears because access rights are only given to the initial admin upon installation, and nothing is done if you later grant permission to another user.

The following PR tries to fix that: Add hooks to fix permissions #155

To any jupyterlab user, feel free to try it out.

lejocelyn · September 30, 2024, 11:08am

I’m interested, but I’m not sure how to setup those hooks. How do I test your PR?

tituspijean · September 30, 2024, 11:41am

sudo yunohost app upgrade jupyterlab -u https://github.com/YunoHost-Apps/jupyterlab_ynh/tree/fix-permissions -F

lejocelyn · September 30, 2024, 11:48am

Not, it didn’t solve anything for me: hastebin

orhtej2 · September 30, 2024, 12:08pm

Can you try granting app access to an individual user (via web admin->users->manage groups and permissions) and see if this works for that user alone?

lejocelyn · September 30, 2024, 12:13pm

I just created a new user, lejocelyn_user. I tried then to log with it, didn’t work. I even granted specific rights (though the web interface), even though is redundant, but to no avail

PS : In case it’s useful : hastebin ; I restarted as well the service after doing the rights update. Would restarting the server help?

orhtej2 · September 30, 2024, 12:21pm

Assuming you have SSH access, can you try running:

groups lejocelyn_user

To see if lejocelyn_user is a member of jupyterlab group?

Moreover, can you try running

getent group jupyterlab

To see who’s the member of jupyterlab group?

lejocelyn · September 30, 2024, 12:34pm

Here are the results:

lejocelyn_admin@serveur:~$ groups lejocelyn_user
 lejocelyn_user : lejocelyn_user jupyterlab all_users mail.main invidious.main overleaf.main opensondage.main nextcloud.main nextcloud.api collabora.main jupyterlab.main
lejocelyn_admin@serveur:~$ getent group jupyterlab
 jupyterlab:x:990:jupyterlab,fseifart,lejocelyn_admin,androng,lejocelyn_user

orhtej2 · September 30, 2024, 12:43pm

So the fix did what it was supposed to do, it’s just not enough somehow

lejocelyn · September 30, 2024, 12:49pm

What about the difference between jupyterlab and jupyterhub? Maybe there is an issue on the name level. Also, when I do groups lejocelyn_user, I see both jupyterlab and jupyterlab.main, could it be related too?

orhtej2 · September 30, 2024, 1:19pm

After too many attempts I feel defeated.
Without adding c.Authenticator.allow_all = True to config/jupyterhub_config.py I was unable to log in at all, after adding it I was able to log in but never to start the server, and that’s because jupyterlab keeps trying to interact with /home/{user}/.local/shared and keeps getting rejected.

I’m out of ideas.

ericg · September 30, 2024, 2:26pm

there was a PR done to fix permission issue on user (this has been reverted I can’t remember why)

github.com/YunoHost-Apps/jupyterlab_ynh

Specify user and group in systemd unit file

YunoHost-Apps:testing ← Jules-Bertholet:patch-1

opened 11:40PM - 28 May 21 UTC

Jules-Bertholet

+1714 -85

Fix CI warning ## Problem - User and group were missing ## Solution - Ad…ded them ## PR Status - [x] Code finished. - [ ] Tested with Package_check. - [x] Fix or enhancement tested. - [ ] Upgrade from last version tested. - [x] Can be reviewed and tested. ## Package_check results --- * An automatic package_check will be launch at https://ci-apps-dev.yunohost.org/, when you add a specific comment to your Pull Request: "!testme", "!gogogadgetoci" or "By the power of systemd, I invoke The Great App CI to test this Pull Request!"*

jarod5001 · September 30, 2024, 4:04pm

Not sure if this is related Invalid username and password · Issue #156 · YunoHost-Apps/jupyterlab_ynh · GitHub
I also can’t log in with a fresh install

jarod5001 · September 30, 2024, 10:26pm

According to the install script, LDAP Authenticator Plugin for Jupyter is installed.

The usage section says :

You can enable this authenticator by adding lines to your jupyterhub_config.py.

Note: This file may not exist in your current installation! In TLJH, it is located in /opt/tljh/config/jupyterhub_config.d. Create it there if you don’t already have one.

c.JupyterHub.authenticator_class = 'ldap'

This folder does not exist but there is a config file in : /opt/jupyterlab/config/jupyterhub_config.py

I opened it and looked for the authentication config and I found :
c.JupyterHub.authenticator_class = 'ldapauthenticator.LDAPAuthenticator'

This also may help.

Edit :
I got it fixed Invalid username and password · Issue #156 · YunoHost-Apps/jupyterlab_ynh · GitHub

I added this line
c.Authenticator.allow_all = True
In /opt/jupyterlab/config/jupyterhub_config.py

jarod5001 · October 1, 2024, 7:51am

I forgot to mention that the Jupyter service needs to be restarted.
But other users in ldap are not in the allow list.

lejocelyn · October 1, 2024, 8:36am

It seems to work for me too thanks

orhtej2 · October 1, 2024, 9:16am

Does it actually start a notebook with this line?