search

jupyter / jupyter_client

Jupyter protocol client APIs
https://jupyter-client.readthedocs.io
BSD 3-Clause "New" or "Revised" License
382 stars 281 forks source link

win32security.GetFileSecurity kernel error in jupyter- lab v1.1.4 client v5.3.3 #481

Closed wikwok closed 4 years ago

wikwok commented 4 years ago

Description

Launching jupyter notebook v1.1.4 python3.7 from Anaconda3 throws kernel error on windows 8.1

Default installation of jupyterlab v1.0.2 compiled with Anaconda3 works fine and not prone to this error.

Also Mac seems not prone to this issue when testing it on Mac.

Traceback (most recent call last):
  File "C:\Users\xxx\.conda\envs\logAna\lib\site-packages\tornado\web.py", line 1699, in _execute
    result = await result
  File "C:\Users\xxx\.conda\envs\logAna\lib\site-packages\tornado\gen.py", line 742, in run
    yielded = self.gen.throw(*exc_info)  # type: ignore
  File "C:\Users\xxx\.conda\envs\logAna\lib\site-packages\notebook\services\sessions\handlers.py", line 72, in post
    type=mtype))
  File "C:\Users\sxxx\.conda\envs\logAna\lib\site-packages\tornado\gen.py", line 735, in run
    value = future.result()
  File "C:\Users\xxx\.conda\envs\logAna\lib\site-packages\tornado\gen.py", line 742, in run
    yielded = self.gen.throw(*exc_info)  # type: ignore
  File "C:\Users\xxx\.conda\envs\logAna\lib\site-packages\notebook\services\sessions\sessionmanager.py", line 88, in create_session
    kernel_id = yield self.start_kernel_for_session(session_id, path, name, type, kernel_name)
  File "C:\Users\xxx\.conda\envs\logAna\lib\site-packages\tornado\gen.py", line 735, in run
    value = future.result()
  File "C:\Users\xxx\.conda\envs\logAna\lib\site-packages\tornado\gen.py", line 742, in run
    yielded = self.gen.throw(*exc_info)  # type: ignore
  File "C:\Users\xxx\.conda\envs\logAna\lib\site-packages\notebook\services\sessions\sessionmanager.py", line 101, in start_kernel_for_session
    self.kernel_manager.start_kernel(path=kernel_path, kernel_name=kernel_name)
  File "C:\Users\xxx\.conda\envs\logAna\lib\site-packages\tornado\gen.py", line 735, in run
    value = future.result()
  File "C:\Users\xxx\.conda\envs\logAna\lib\site-packages\tornado\gen.py", line 209, in wrapper
    yielded = next(result)
  File "C:\Users\xxx\.conda\envs\logAna\lib\site-packages\notebook\services\kernels\kernelmanager.py", line 168, in start_kernel
    super(MappingKernelManager, self).start_kernel(**kwargs)
  File "C:\Users\xxx\.conda\envs\logAna\lib\site-packages\jupyter_client\multikernelmanager.py", line 110, in start_kernel
    km.start_kernel(**kwargs)
  File "C:\Users\xxx\.conda\envs\logAna\lib\site-packages\jupyter_client\manager.py", line 240, in start_kernel
    self.write_connection_file()
  File "C:\Users\xxx\.conda\envs\logAna\lib\site-packages\jupyter_client\connect.py", line 547, in write_connection_file
    kernel_name=self.kernel_name
  File "C:\Users\xxx\.conda\envs\logAna\lib\site-packages\jupyter_client\connect.py", line 212, in write_connection_file
    with secure_write(fname) as f:
  File "C:\Users\xxx\.conda\envs\logAna\lib\contextlib.py", line 112, in __enter__
    return next(self.gen)
  File "C:\Users\xxx\.conda\envs\logAna\lib\site-packages\jupyter_client\connect.py", line 100, in secure_write
    win32_restrict_file_to_user(fname)
  File "C:\Users\xxx\.conda\envs\logAna\lib\site-packages\jupyter_client\connect.py", line 61, in win32_restrict_file_to_user
    sd = win32security.GetFileSecurity(fname, win32security.DACL_SECURITY_INFORMATION)
pywintypes.error: (50, 'GetFileSecurity', 'The request is not supported.')

Reproduce

At first instance jupyter was automatically updated when installing other Anaconda3 packages which seemed to cause the error. However, after testing lots of setups and finally installing jupyterlab on a fresh clean anaconda environment determined that the new version has got a bug running on windows 8.1 Enterprise 64bit SP0 at the least. I don't know if other versions of windows are prone to this.

Expected behavior

create new python3.7 notebooks without any kernel errors.

Context

Troubleshoot Output 

(base) C:\WINDOWS\system32>activate test

(test) C:\WINDOWS\system32>jupyter troubleshoot
$PATH:
        C:\Users\xxx\.conda\envs\test
        C:\Users\xxx\.conda\envs\test\Library\mingw-w64\bin
        C:\Users\xxx\.conda\envs\test\Library\usr\bin
        C:\Users\xxx\.conda\envs\test\Library\bin
        C:\Users\xxx\.conda\envs\test\Scripts
        C:\Users\xxx\.conda\envs\test\bin
        C:\ProgramData\Anaconda3\condabin
        C:\oracle\Oracle11g\product\11.2.0\client_1\bin
        C:\Rtools\bin
        C:\ProgramData\Oracle\Java\javapath
        C:\WINDOWS\system32
        C:\WINDOWS
        C:\WINDOWS\System32\Wbem
        C:\WINDOWS\System32\WindowsPowerShell\v1.0
        C:\Program Files (x86)\ZANTAZ\EAS Outlook Addin
        C:\Program Files\Liquid Technologies\Liquid Studio 2018\XmlDataBinder16\
Redist16\cpp\win32\bin
        C:\Program Files\Liquid Technologies\Liquid Studio 2018\XmlDataBinder16\
Redist16\cpp\win64\bin
        C:\Program Files\PostgreSQL\11\bin
        C:\Program Files\SAS94\Secure\ccme4
        C:\Program Files\SAS94\x86\Secure\ccme4
        C:\oracle\10.2.0\bin
        C:\BI_HOME\bin
        C:\BI_HOME\jre\1.4.2\bin
        C:\BI_HOME\jre\1.4.2\bin\client
        C:\BI_HOME\jlib
        C:\OpenSSL-Win64\bin
        C:\Program Files (x86)\Microsoft SQL Server\150\DTS\Binn
        C:\Users\xxx\AppData\Local\Programs\Microsoft VS Code\bin

sys.path:
        C:\Users\xxx\.conda\envs\test\Scripts
        C:\Users\xxx\.conda\envs\test\python37.zip
        C:\Users\xxx\.conda\envs\test\DLLs
        C:\Users\xxx\.conda\envs\test\lib
        C:\Users\xxx\.conda\envs\test
        C:\Users\xxx\.conda\envs\test\lib\site-packages
        C:\Users\xxx\.conda\envs\test\lib\site-packages\win32
        C:\Users\xxx\.conda\envs\test\lib\site-packages\win32\lib
        C:\Users\xxx\.conda\envs\test\lib\site-packages\Pythonwin

sys.executable:
        C:\Users\xxx\.conda\envs\test\python.exe

sys.version:
        3.7.4 (default, Aug  9 2019, 18:34:13) [MSC v.1915 64 bit (AMD64)]

platform.platform():
        Windows-8.1-6.3.9600-SP0

where jupyter:
        C:\Users\xxx\.conda\envs\test\Scripts\jupyter.exe

pip list:
        Package           Version
        ----------------- ---------
        attrs             19.1.0
        backcall          0.1.0
        bleach            3.1.0
        certifi           2019.9.11
        colorama          0.4.1
        decorator         4.4.0
        defusedxml        0.6.0
        entrypoints       0.3
        ipykernel         5.1.2
        ipython           7.8.0
        ipython-genutils  0.2.0
        jedi              0.15.1
        Jinja2            2.10.1
        json5             0.8.5
        jsonschema        3.0.2
        jupyter-client    5.3.3
        jupyter-core      4.5.0
        jupyterlab        1.1.4
        jupyterlab-server 1.0.6
        MarkupSafe        1.1.1
        mistune           0.8.4
        nbconvert         5.6.0
        nbformat          4.4.0
        notebook          6.0.1
        pandocfilters     1.4.2
        parso             0.5.1
        pickleshare       0.7.5
        pip               19.2.3
        prometheus-client 0.7.1
        prompt-toolkit    2.0.9
        Pygments          2.4.2
        pyrsistent        0.15.4
        python-dateutil   2.8.0
        pywin32           223
        pywinpty          0.5.5
        pyzmq             18.1.0
        Send2Trash        1.5.0
        setuptools        41.2.0
        six               1.12.0
        terminado         0.8.2
        testpath          0.4.2
        tornado           6.0.3
        traitlets         4.3.2
        wcwidth           0.1.7
        webencodings      0.5.1
        wheel             0.33.6
        wincertstore      0.2

(test) C:\WINDOWS\system32>
Command Line Output 

(base) C:\WINDOWS\system32>activate test

(test) C:\WINDOWS\system32>jupyter lab
[I 15:50:55.678 LabApp] JupyterLab extension loaded from C:\Users\xxx\
.conda\envs\test\lib\site-packages\jupyterlab
[I 15:50:55.678 LabApp] JupyterLab application directory is C:\Users\xxx\.conda\envs\test\share\jupyter\lab
[I 15:50:55.682 LabApp] Serving notebooks from local directory: C:\WINDOWS\syste
m32
[I 15:50:55.682 LabApp] The Jupyter Notebook is running at:
[I 15:50:55.682 LabApp] http://localhost:8888/?token=e2f1c73d291f7e884d3c618eb43
83196c2d75484a0f88d96
[I 15:50:55.682 LabApp]  or http://127.0.0.1:8888/?token=e2f1c73d291f7e884d3c618
eb4383196c2d75484a0f88d96
[I 15:50:55.682 LabApp] Use Control-C to stop this server and shut down all kern
els (twice to skip confirmation).
[C 15:50:55.914 LabApp]

    To access the notebook, open this file in a browser:
        file://A-FILEDATA-COV-P/Profile/xxx/AppData/Roaming/jupyter/ru
ntime/nbserver-8544-open.html
    Or copy and paste one of these URLs:
        http://localhost:8888/?token=e2f1c73d291f7e884d3c618eb4383196c2d75484a0f
88d96
     or http://127.0.0.1:8888/?token=e2f1c73d291f7e884d3c618eb4383196c2d75484a0f
88d96
[W 15:51:04.157 LabApp] Could not determine jupyterlab build status without node
js
[E 15:51:13.236 LabApp] Uncaught exception POST /api/sessions?1569509473167 (::1
)
    HTTPServerRequest(protocol='http', host='localhost:8888', method='POST', uri
='/api/sessions?1569509473167', version='HTTP/1.1', remote_ip='::1')
    Traceback (most recent call last):
      File "C:\Users\xxx\.conda\envs\test\lib\site-packages\tornado\we
b.py", line 1699, in _execute
        result = await result
      File "C:\Users\xxx\.conda\envs\test\lib\site-packages\tornado\ge
n.py", line 742, in run
        yielded = self.gen.throw(*exc_info)  # type: ignore
      File "C:\Users\xxx\.conda\envs\test\lib\site-packages\notebook\s
ervices\sessions\handlers.py", line 72, in post
        type=mtype))
      File "C:\Users\xxx\.conda\envs\test\lib\site-packages\tornado\ge
n.py", line 735, in run
        value = future.result()
      File "C:\Users\xxx\.conda\envs\test\lib\site-packages\tornado\ge
n.py", line 742, in run
        yielded = self.gen.throw(*exc_info)  # type: ignore
      File "C:\Users\xxx\.conda\envs\test\lib\site-packages\notebook\s
ervices\sessions\sessionmanager.py", line 88, in create_session
        kernel_id = yield self.start_kernel_for_session(session_id, path, name,
type, kernel_name)
      File "C:\Users\xxx\.conda\envs\test\lib\site-packages\tornado\ge
n.py", line 735, in run
        value = future.result()
      File "C:\Users\xxx\.conda\envs\test\lib\site-packages\tornado\ge
n.py", line 742, in run
        yielded = self.gen.throw(*exc_info)  # type: ignore
      File "C:\Users\xxx\.conda\envs\test\lib\site-packages\notebook\s
ervices\sessions\sessionmanager.py", line 101, in start_kernel_for_session
        self.kernel_manager.start_kernel(path=kernel_path, kernel_name=kernel_na
me)
      File "C:\Users\xxx\.conda\envs\test\lib\site-packages\tornado\ge
n.py", line 735, in run
        value = future.result()
      File "C:\Users\xxx\.conda\envs\test\lib\site-packages\tornado\ge
n.py", line 209, in wrapper
        yielded = next(result)
      File "C:\Users\xxx\.conda\envs\test\lib\site-packages\notebook\s
ervices\kernels\kernelmanager.py", line 168, in start_kernel
        super(MappingKernelManager, self).start_kernel(**kwargs)
      File "C:\Users\xxx\.conda\envs\test\lib\site-packages\jupyter_cl
ient\multikernelmanager.py", line 110, in start_kernel
        km.start_kernel(**kwargs)
      File "C:\Users\xxx\.conda\envs\test\lib\site-packages\jupyter_cl
ient\manager.py", line 240, in start_kernel
        self.write_connection_file()
      File "C:\Users\xxx\.conda\envs\test\lib\site-packages\jupyter_cl
ient\connect.py", line 547, in write_connection_file
        kernel_name=self.kernel_name
      File "C:\Users\xxx\.conda\envs\test\lib\site-packages\jupyter_cl
ient\connect.py", line 212, in write_connection_file
        with secure_write(fname) as f:
      File "C:\Users\xxx\.conda\envs\test\lib\contextlib.py", line 112
, in __enter__
        return next(self.gen)
      File "C:\Users\xxx\.conda\envs\test\lib\site-packages\jupyter_cl
ient\connect.py", line 100, in secure_write
        win32_restrict_file_to_user(fname)
      File "C:\Users\xxx\.conda\envs\test\lib\site-packages\jupyter_cl
ient\connect.py", line 61, in win32_restrict_file_to_user
        sd = win32security.GetFileSecurity(fname, win32security.DACL_SECURITY_IN
FORMATION)
    pywintypes.error: (50, 'GetFileSecurity', 'The request is not supported.')
[W 15:51:13.245 LabApp] Unhandled error
[E 15:51:13.247 LabApp] {
      "Host": "localhost:8888",
      "Connection": "keep-alive",
      "Content-Length": "97",
      "Authorization": "token e2f1c73d291f7e884d3c618eb4383196c2d75484a0f88d96",

      "Origin": "http://localhost:8888",
      "X-Xsrftoken": "2|e0797587|bfb0295d2cfd16737a016247e6e4c3bb|1569403253",
      "User-Agent": "Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36
 (KHTML, like Gecko) Chrome/73.0.3683.75 Safari/537.36",
      "Content-Type": "application/json",
      "Accept": "*/*",
      "Referer": "http://localhost:8888/lab",
      "Accept-Encoding": "gzip, deflate, br",
      "Accept-Language": "en-US,en;q=0.9",
      "Cookie": "_xsrf=2|e0797587|bfb0295d2cfd16737a016247e6e4c3bb|1569403253; u
sername-localhost-8889=\"2|1:0|10:1569504770|23:username-localhost-8889|44:NGY0Y
jJmZTI2MDZiNGU1ZDk5MTNjYjY3MTcwYjdlMDM=|caa84e45c938a438e74fe746b2d337a2e50d7882
a22c70ec0f114d22aa337feb\"; username-localhost-8888=\"2|1:0|10:1569509473|23:use
rname-localhost-8888|44:MDFkMmNlYjcwYzgxNGY3M2JlYmFjYTA4OTE2MGMwNDI=|d3bdb147f2b
afff4d6e7528326a74e6b7d13199b6f63400e84e2c00af8337dbf\""
    }
[E 15:51:13.248 LabApp] 500 POST /api/sessions?1569509473167 (::1) 69.19ms refer
er=http://localhost:8888/lab
[E 15:51:38.978 LabApp] Uncaught exception POST /api/sessions?1569509497781 (::1
)
    HTTPServerRequest(protocol='http', host='localhost:8888', method='POST', uri
='/api/sessions?1569509497781', version='HTTP/1.1', remote_ip='::1')
    Traceback (most recent call last):
      File "C:\Users\xxx\.conda\envs\test\lib\site-packages\tornado\we
b.py", line 1699, in _execute
        result = await result
      File "C:\Users\xxx\.conda\envs\test\lib\site-packages\tornado\ge
n.py", line 742, in run
        yielded = self.gen.throw(*exc_info)  # type: ignore
      File "C:\Users\xxx\.conda\envs\test\lib\site-packages\notebook\s
ervices\sessions\handlers.py", line 72, in post
        type=mtype))
      File "C:\Users\xxx\.conda\envs\test\lib\site-packages\tornado\ge
n.py", line 735, in run
        value = future.result()
      File "C:\Users\xxx\.conda\envs\test\lib\site-packages\tornado\ge
n.py", line 742, in run
        yielded = self.gen.throw(*exc_info)  # type: ignore
      File "C:\Users\xxx\.conda\envs\test\lib\site-packages\notebook\s
ervices\sessions\sessionmanager.py", line 88, in create_session
        kernel_id = yield self.start_kernel_for_session(session_id, path, name,
type, kernel_name)
      File "C:\Users\xxx\.conda\envs\test\lib\site-packages\tornado\ge
n.py", line 735, in run
        value = future.result()
      File "C:\Users\xxx\.conda\envs\test\lib\site-packages\tornado\ge
n.py", line 742, in run
        yielded = self.gen.throw(*exc_info)  # type: ignore
      File "C:\Users\xxx\.conda\envs\test\lib\site-packages\notebook\s
ervices\sessions\sessionmanager.py", line 101, in start_kernel_for_session
        self.kernel_manager.start_kernel(path=kernel_path, kernel_name=kernel_na
me)
      File "C:\Users\xxx\.conda\envs\test\lib\site-packages\tornado\ge
n.py", line 735, in run
        value = future.result()
      File "C:\Users\xxx\.conda\envs\test\lib\site-packages\tornado\ge
n.py", line 209, in wrapper
        yielded = next(result)
      File "C:\Users\xxx\.conda\envs\test\lib\site-packages\notebook\s
ervices\kernels\kernelmanager.py", line 168, in start_kernel
        super(MappingKernelManager, self).start_kernel(**kwargs)
      File "C:\Users\xxx\.conda\envs\test\lib\site-packages\jupyter_cl
ient\multikernelmanager.py", line 110, in start_kernel
        km.start_kernel(**kwargs)
      File "C:\Users\xxx\.conda\envs\test\lib\site-packages\jupyter_cl
ient\manager.py", line 240, in start_kernel
        self.write_connection_file()
      File "C:\Users\xxx\.conda\envs\test\lib\site-packages\jupyter_cl
ient\connect.py", line 547, in write_connection_file
        kernel_name=self.kernel_name
      File "C:\Users\xxx\.conda\envs\test\lib\site-packages\jupyter_cl
ient\connect.py", line 212, in write_connection_file
        with secure_write(fname) as f:
      File "C:\Users\xxx\.conda\envs\test\lib\contextlib.py", line 112
, in __enter__
        return next(self.gen)
      File "C:\Users\xxx\.conda\envs\test\lib\site-packages\jupyter_cl
ient\connect.py", line 100, in secure_write
        win32_restrict_file_to_user(fname)
      File "C:\Users\xxx\.conda\envs\test\lib\site-packages\jupyter_cl
ient\connect.py", line 61, in win32_restrict_file_to_user
        sd = win32security.GetFileSecurity(fname, win32security.DACL_SECURITY_IN
FORMATION)
    pywintypes.error: (50, 'GetFileSecurity', 'The request is not supported.')
[W 15:51:38.984 LabApp] Unhandled error
[E 15:51:38.985 LabApp] {
      "Host": "localhost:8888",
      "Connection": "keep-alive",
      "Content-Length": "97",
      "Pragma": "no-cache",
      "Cache-Control": "no-cache",
      "Authorization": "token e2f1c73d291f7e884d3c618eb4383196c2d75484a0f88d96",

      "Origin": "http://localhost:8888",
      "X-Xsrftoken": "2|e0797587|bfb0295d2cfd16737a016247e6e4c3bb|1569403253",
      "User-Agent": "Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36
 (KHTML, like Gecko) Chrome/73.0.3683.75 Safari/537.36",
      "Content-Type": "application/json",
      "Accept": "*/*",
      "Referer": "http://localhost:8888/lab",
      "Accept-Encoding": "gzip, deflate, br",
      "Accept-Language": "en-US,en;q=0.9",
      "Cookie": "_xsrf=2|e0797587|bfb0295d2cfd16737a016247e6e4c3bb|1569403253; u
sername-localhost-8889=\"2|1:0|10:1569504770|23:username-localhost-8889|44:NGY0Y
jJmZTI2MDZiNGU1ZDk5MTNjYjY3MTcwYjdlMDM=|caa84e45c938a438e74fe746b2d337a2e50d7882
a22c70ec0f114d22aa337feb\"; username-localhost-8888=\"2|1:0|10:1569509486|23:use
rname-localhost-8888|44:OWMzYTU5MjgzZDQ0NDQ5Zjk3ZDZkYzUzNTE5MDYxMjQ=|fc18aa7b12f
dfb162c64a2236e57c93d1088d13b7ae52fd63a37ffd9e815de38\""
    }
[E 15:51:38.986 LabApp] 500 POST /api/sessions?1569509497781 (::1) 25.07ms refer
er=http://localhost:8888/lab
Browser Output 
Starting application in workspace: "/lab"
api/sessions?1569509473167:1 
Failed to load resource: the server responded with a status of 500 (Internal Server Error)
serverconnection.js:193 
POST http://localhost:8888/api/sessions?1569509497781 500 (Internal Server Error)
handleRequest @ serverconnection.js:193
makeRequest @ serverconnection.js:75
startSession @ default.js:636
startNew @ default.js:614
startNew @ default.js:378
startNew @ session.js:50
startNew @ manager.js:166
_startSession @ clientsession.js:418
_changeKernel @ clientsession.js:370
(anonymous) @ clientsession.js:403
serverconnection.js:89 
Uncaught (in promise) Error: Invalid response: 500 Internal Server Error
    at default.js:639
    at async SessionManager.startNew (manager.js:166)
ResponseError @ serverconnection.js:89
(anonymous) @ default.js:639
vidartf commented 4 years ago

For context:; The original report was for Jupyterlab (https://github.com/jupyterlab/jupyterlab/issues/7269), so version 1.1.4 refers to the lab version.

jasongrout commented 4 years ago

Just to be clear here, this is a jupyter_client issue, not a JupyterLab issue. What version of jupyter_client do you have?

vidartf commented 4 years ago

It says in the pip output, 5.3.3.

tomanizer commented 4 years ago

exactly the same issue after upgrading jupyterlab: Windows 7 Python 3.6

jupyter 1.0.0 py_2 conda-forge jupyter-server-proxy 1.1.0 pypi_0 pypi jupyter_client 5.3.3 py36_1 conda-forge jupyter_console 6.0.0 py_0 conda-forge jupyter_core 4.4.0 py_0 conda-forge jupyterlab 1.1.4 py_0 conda-forge jupyterlab_server 1.0.6 py_0 conda-forge

after starting a kernel in the browser, it fails with: File "C:\Miniconda3\envs\svass\lib\site-packages\jupyter_client\connect.py", line 100, in secure_write win32_restrict_file_to_user(fname) File "C:\Miniconda3\envs\svass\lib\site-packages\jupyter_client\connect.py", line 61, in win32_restrict_file_to_user sd = win32security.GetFileSecurity(fname, win32security.DACL_SECURITY_INFORMATION) pywintypes.error: (50, 'GetFileSecurity', 'The request is not supported.')

kevin-bates commented 4 years ago

A recent build of pywin32 (225) fixed access rights, one of which is used in this code. However, I would have expected the failure to occur on the SetFileSecurity call since the ACE being added references one of the affected access rights (FILE_ACCESS_ALL).

At any rate, it might be worth stopping the notebook server and running conda install pywin32, then ensuring the version of pywin32 is 225 and retry.

tomanizer commented 4 years ago

Pywin225 does not seem to resolve the issue.

Here is what i did: My pywin32 version was indeed 224.

Conda pywin225 does not seem to be available on conda for 3.6 64bit.

Binary install Pywin32 recommends download and installation from binaries. However cannot do this due to llack of admin rights.

Pip install (experimental) Experimental pip install is available for pywin32 225, but fails with "requires libarchive-c". After manually pip installing libarchive-c: pip install pywin32 --upgrade succeeds and installs 225

But after selecting the kernel: File "C:\UBS\Dev\Miniconda3\envs\svass\lib\site-packages\jupyter_client\connect.py", line 100, in secure_write win32_restrict_file_to_user(fname) File "C:\Miniconda3\envs\svass\lib\site-packages\jupyter_client\connect.py", line 61, in win32_restrict_file_to_user sd = win32security.GetFileSecurity(fname, win32security.DACL_SECURITY_INFORMATION) pywintypes.error: (50, 'GetFileSecurity', 'The request is not supported.')

tomanizer commented 4 years ago

related to this issue?

https://stackoverflow.com/questions/58075788/pywintypes-error-50-getfilesecurity-the-request-is-not-supported-while

the culprit is jupyter-client >= 5.3.2 downgrading to 5.3.1 resolves the issue.

pip install jupyter-client==5.3.1

Dr-Irv commented 4 years ago

With jupyterlab_server=1.0.6 and jupyter_client=5.3.3, I had the same issue. This is on Windows 10, python 3.7.3.

If I just downgraded jupyter_client to 5.3.1, then the error went away, but I couldn't hit Shift-Enter to run any cells in Jupyter Lab. So I had to downgrade jupyter_client to 5.3.1 and jupyterlab_server to 1.0.0.

conda install jupyterlab_server=1.0.0 jupyter_client=5.3.1

Shongololo commented 4 years ago

Spyder 4.0.1 won't run without the latest version of the jupyter_client. So a downgrade to 5.3.1 won't work for me. Any other suggestions? Must be an issue within the jupyter_client?

MSeal commented 4 years ago

The issue is usually that mounted file systems, especially in windows, don't actually provide permission bit manipulation to the underlying files. Meaning when jupyter / your home directory is in such a mounted file system it can't save your connection file secrets securely and fails when saving or checking permissions. If you have a path on your system which isn't restricted in permissions you can set JUPYTER_RUNTIME_DIR or JUPYTER_DATA_DIR if you install your kernels to the location. This should enable your connection file to properly save with secure permissions on the secret file.

Shongololo commented 4 years ago

Thanks. I tried a 'set jupyter runtime-dir=c:\ProgramData\jupyter' but no luck the path stayed the same after I ran 'jupyter --paths'. Still pointed to my roaming profile...

kevin-bates commented 4 years ago

I don't remember the syntax for setting environment variables on Windows, but you'll want to use uppercase and under bars in your variable name, something like this:

set JUPYTER_RUNTIME_DIR=c:\ProgramData\jupyter

Before that, however, you should upgrade jupyter_client - which will also upgrade jupyter_core. They should be at versions 5.3.4 and 4.6.2 respectively.

Shongololo commented 4 years ago

Thanks again! Progress.... I managed to upgrade both Jupyter and Spyder (4.0.1). Then ran

set JUPYTER_RUNTIME_DIR=c:\ProgramData\jupyter

I had to back track and move the 'kernels' and 'runtime' folders into the above path. When I ran spyder from the Anaconda prompt - success!! This after the set command above. No more win32security error!

However, when I run spyder from the icon on my toolbar the jupyter runtime directory is somehow lost so back to my old error. Now just to figure out how to get my set JUPYTER_RUNTIME_DIR to stick...

wikwok commented 4 years ago

I don't remember the syntax for setting environment variables on Windows, but you'll want to use uppercase and under bars in your variable name, something like this:

set JUPYTER_RUNTIME_DIR=c:\ProgramData\jupyter

Before that, however, you should upgrade jupyter_client - which will also upgrade jupyter_core. They should be at versions 5.3.4 and 4.6.2 respectively.

Thank you @kevin-bates !

I have just had success. Just need to find out a way to make the setting persist, as this command seems to only work for the session inside the cmd.

This is my story for anyone else to learn (I run Anconda which comes pre installed with Jupyter):

1- When checking the environment paths by using this command: jupyter --paths I get two roaming locations one for runtime and one for data! This is because I use a corporate laptop and Windows is setup to store user data files in a roaming location on the network! 

(base) C:\>jupyter --paths
config:
    C:\Users\user_x\.jupyter
    C:\ProgramData\Anaconda3\etc\jupyter
    C:\ProgramData\jupyter
data:
    \\A-FILEDATA-P\Profile\use_x\AppData\Roaming\jupyter
    C:\ProgramData\Anaconda3\share\jupyter
    C:\ProgramData\jupyter
runtime:
    \\A-FILEDATA-P\Profile\use_x\AppData\Roaming\jupyter\runtime

(base) C:\>

2- So, I tried modifying C:\Users\user_xxx.jupyter\jupyter_notebook_config.py by adding JUPYTER_RUNTIME_DIR = 'C:\Users\user_x\AppData\Roaming\jupyter\runtime' but it did not work!

2- However, Big note here: I noticed that jupyter lab command fire a "stand alone" Chrome I have on a removable usb harddisk! which under the corporate Windows setup does not have any rights to write to other folder location on the laptop, thus the security error!

3- The solution was to setup two folders on my usb disk, where stand alone Chrome is found and set the environment variables to point to those locations like this:

set JUPYTER_RUNTIME_DIR=D:\jupyter\runtime
set JUPYTER_DATA_DIR=D:\jupyter

4- The only catch is that you have to do these two commands at the start of every new session as they don't persist say when you restart Jupyter lab! and as @Shongololo pointed out you can only run other programs like Spyder from the command line only for it to read the correct settings!

It remains to be found out how this could be resolved permanently.

Shongololo commented 4 years ago

Hi. I figured out how to get it to 'stick' by modifying my system envs for Windows 10. Done as follows: Open the Start Search, type in “env”, and choose “Edit the system environment variables”: Click the “Environment Variables…” button. Then 'New' System Variable. Add a line - Variable name = "JUPYTER_RUNTIME_DIR". Value = %path you want%. In my case it was c:\ProgramData\jupyter

kevin-bates commented 4 years ago

If you're in an environment in which security of the running kernel connections is not a concern, another workaround exists via the recently released 4.6.2 version of jupyter_core. The workaround is to set the environment variable JUPYTER_ALLOW_INSECURE_WRITES=True.

Once set, and the offending Jupyter application restarted, the permission check for any file written by secure_write() will not be enforced. You'll also see some warning messages indicating that this setting is enabled and how to restore secure writes.

You'll still need to make this env variable "stick" by adding it to the set of system envs as @Shongololo points out.

tomanizer commented 4 years ago

No success with @kevin-bates suggestion on jupyter_core 4.6.2 and jupyter_client 5.3.4 on Windows 7.

After setting the environment variable jupyter starts with a warning message: WARNING: Insecure writes have been enabled via environment variable 'JUPYTER_ALLOW_INSECURE_WRITES'! If this is not intended, remove the variable or set its value to 'False'.

However, when starting up a kernel, request still fails with pywintypes error when attempting to restrict file to user: File "C:\Programs\Miniconda3_64\envs\jup369\lib\site-packages\jupyter_core\paths.py", line 430, in secure_write win32_restrict_file_to_user(fname) File "C:\Programs\Miniconda3_64\envs\jup369\lib\site-packages\jupyter_core\paths.py", line 369, in win32_restrict_file_to_user sd = win32security.GetFileSecurity(fname, win32security.DACL_SECURITY_INFORMATION) pywintypes.error: (50, 'GetFileSecurity', 'The request is not supported.')

The user is not admin on the machine, but can write to the paths listed in: jupyter --paths

So far, only downgrade to jupyter_client 5.3.1 has been successful.

Denwid commented 4 years ago

Can confirm, JUPYTER_ALLOW_INSECURE_WRITES does not work to resolve the problem @tomanizer

This issue is messing majorly with jupyter in corporate setups.

kevin-bates commented 4 years ago

This issue is different and won't be affected by the new env variable. For this issue, the focus should be returned to pywin32.

I'm hoping @MSeal has some insights on Windows package/library issues.

One workaround you might try is @wikwok's above: https://github.com/jupyter/jupyter_client/issues/481#issuecomment-586636270.

MSeal commented 4 years ago

I think when in insecure mode we should skip trying to do any windows ACL permissions as the number of exceptions that could be raised when you have partial or no permissions if high and hard for us to guarantee would be caught without catching all exceptions (not a good idea either). @kevin-bates we'll need another PR, I'll get it up tonight to cover this path.

Longer term perhaps jupyter should be using the registry on windows to either find a path to stash secrets, or to stash the secrets themselves, as the default file system paths jupyter selects aren't guaranteed to be editable / permissible in the way needed for secure writes.

This issue is messing majorly with jupyter in corporate setups.

Apologies for that. It would help to know what the mounted file system is and if it's your whole filesystem or just a single folder. It seems like the whole home directory is mounted in a way that permissions can't be set, which seems like it'd be problematic for other applications that write to the .AppData and other private home folders. But I don't actually have a reproducible setup for this error so it's difficult to say what that setup is.

kevin-bates commented 4 years ago

Thanks @MSeal!

MSeal commented 4 years ago

jupyter_core 4.6.3 is now released with a skip for these checks when in insecure mode -- @Denwid could you try upgrading that package and retrying with the insecure mode set?

MSeal commented 4 years ago

and @tomanizer :point_up: