Permission Denied After installing WSL on windowns

[yli110-stat697]

Hi, I have been using Jupyter Notebook on Mac and Windows without issues, but after I installed WSL(window subsystem linux), I cannot open jupyter notebook in my main windows system. I can launch the web server, but when I opened the old or new notebooks, I saw kernel error with the messages below. Traceback (most recent call last): File "c:\python3\lib\site-packages\tornado\web.py", line 1699, in _execute result = await result File "c:\python3\lib\site-packages\tornado\gen.py", line 742, in run yielded = self.gen.throw(*exc_info) # type: ignore File "c:\python3\lib\site-packages\notebook\services\sessions\handlers.py", line 72, in post type=mtype)) File "c:\python3\lib\site-packages\tornado\gen.py", line 735, in run value = future.result() File "c:\python3\lib\site-packages\tornado\gen.py", line 742, in run yielded = self.gen.throw(*exc_info) # type: ignore File "c:\python3\lib\site-packages\notebook\services\sessions\sessionmanager.py", line 88, in create_session kernel_id = yield self.start_kernel_for_session(session_id, path, name, type, kernel_name) File "c:\python3\lib\site-packages\tornado\gen.py", line 735, in run value = future.result() File "c:\python3\lib\site-packages\tornado\gen.py", line 742, in run yielded = self.gen.throw(*exc_info) # type: ignore File "c:\python3\lib\site-packages\notebook\services\sessions\sessionmanager.py", line 101, in start_kernel_for_session self.kernel_manager.start_kernel(path=kernel_path, kernel_name=kernel_name) File "c:\python3\lib\site-packages\tornado\gen.py", line 735, in run value = future.result() File "c:\python3\lib\site-packages\tornado\gen.py", line 209, in wrapper yielded = next(result) File "c:\python3\lib\site-packages\notebook\services\kernels\kernelmanager.py", line 168, in start_kernel super(MappingKernelManager, self).start_kernel(**kwargs) File "c:\python3\lib\site-packages\jupyter_client\multikernelmanager.py", line 110, in start_kernel km.start_kernel(**kwargs) File "c:\python3\lib\site-packages\jupyter_client\manager.py", line 240, in start_kernel self.write_connection_file() File "c:\python3\lib\site-packages\jupyter_client\connect.py", line 547, in write_connection_file kernel_name=self.kernel_name File "c:\python3\lib\site-packages\jupyter_client\connect.py", line 212, in write_connection_file with secure_write(fname) as f: File "c:\python3\lib\contextlib.py", line 112, in __enter__ return next(self.gen) File "c:\python3\lib\site-packages\jupyter_client\connect.py", line 102, in secure_write with os.fdopen(os.open(fname, open_flag, 0o600), mode) as f: PermissionError: [Errno 13] Permission denied: 'C:\\Users\\Yli.ECHO\\AppData\\Roaming\\jupyter\\runtime\\kernel-9c3baad7-8b57-4d76-b198-d10d32db46e6.json'

when I run as administrator or run jupyter notebooks in WSL, I'm still able to access the files. Only when I'm in the main system, the problem above appears. This is like a mystery that bugs me... Please help if you can.

[kevin-bates]

Hi @yli110-stat697 - this is a duplicate of #4907. You might find info in this comment helpful.

[yli110-stat697]

@kevin-bates I see. Thank you! Yeah, I have been trying numerous suggestions from stackoverflow users, but none really worked out. Will look through your comments to see if anything works. THANKS AGAIN, and will keep you updated.

[yli110-stat697]

@kevin-bates Hi, I see you and @snapo were having a discussion, and I tried to read through but got lost some where. I'm willing to share the settings on my computer if you are willing to take a look at?

1. When I check user accounts on windows, I see two users there: YLi with Domain YLI8059FC has group of Administrators and Users, and yli with Domain ECHO has group of docker-users and administrators. -- Do you think the order of the groups make a difference? I doubt it

2. dir C:\Users\Yli.ECHO\AppData\Roaming\jupyter\runtime\kernel-67c2190c-890a-4e5b-90fc-54f9ee212be8.json gives me the output below in command prompt.

 Volume Serial Number is CC21-0422

 Directory of C:\Users\Yli.ECHO\AppData\Roaming\jupyter\runtime

10/03/2019  11:12 AM                 0 kernel-67c2190c-890a-4e5b-90fc-54f9ee212be8.json
               1 File(s)              0 bytes
               0 Dir(s)  165,489,729,536 bytes free 

Then I tried @snapo's get-alc, cmd said 'get-acl' is not recognized as an internal or external command,operable program or batch file. But I can run the get-acl in powershell, result is

be8.json

    Directory: C:\Users\Yli.ECHO\AppData\Roaming\jupyter\runtime

Path                                             Owner    Access
----                                             -----    ------
kernel-67c2190c-890a-4e5b-90fc-54f9ee212be8.json ECHO\yli BUILTIN\Administrators Allow  FullControl... 

3. I cannot use the security scan for kernal.json file as the IT in my company disabled that function.

I know I created virtual env before and deleted afterwards, but I don't know how to check if that's the issue. Any suggestions?

Thank you!

[yli110-stat697]

And I followed @snapo 's suggestion at the end of #4907 , got FileNotFoundError.

Traceback (most recent call last):
  File "c:\python3\lib\site-packages\tornado\web.py", line 1699, in _execute
    result = await result
  File "c:\python3\lib\site-packages\tornado\gen.py", line 742, in run
    yielded = self.gen.throw(*exc_info)  # type: ignore
  File "c:\python3\lib\site-packages\notebook\services\sessions\handlers.py", line 72, in post
    type=mtype))
  File "c:\python3\lib\site-packages\tornado\gen.py", line 735, in run
    value = future.result()
  File "c:\python3\lib\site-packages\tornado\gen.py", line 742, in run
    yielded = self.gen.throw(*exc_info)  # type: ignore
  File "c:\python3\lib\site-packages\notebook\services\sessions\sessionmanager.py", line 88, in create_session
    kernel_id = yield self.start_kernel_for_session(session_id, path, name, type, kernel_name)
  File "c:\python3\lib\site-packages\tornado\gen.py", line 735, in run
    value = future.result()
  File "c:\python3\lib\site-packages\tornado\gen.py", line 742, in run
    yielded = self.gen.throw(*exc_info)  # type: ignore
  File "c:\python3\lib\site-packages\notebook\services\sessions\sessionmanager.py", line 101, in start_kernel_for_session
    self.kernel_manager.start_kernel(path=kernel_path, kernel_name=kernel_name)
  File "c:\python3\lib\site-packages\tornado\gen.py", line 735, in run
    value = future.result()
  File "c:\python3\lib\site-packages\tornado\gen.py", line 209, in wrapper
    yielded = next(result)
  File "c:\python3\lib\site-packages\notebook\services\kernels\kernelmanager.py", line 168, in start_kernel
    super(MappingKernelManager, self).start_kernel(**kwargs)
  File "c:\python3\lib\site-packages\jupyter_client\multikernelmanager.py", line 110, in start_kernel
    km.start_kernel(**kwargs)
  File "c:\python3\lib\site-packages\jupyter_client\manager.py", line 259, in start_kernel
    **kw)
  File "c:\python3\lib\site-packages\jupyter_client\manager.py", line 204, in _launch_kernel
    return launch_kernel(kernel_cmd, **kw)
  File "c:\python3\lib\site-packages\jupyter_client\launcher.py", line 138, in launch_kernel
    proc = Popen(cmd, **kwargs)
  File "c:\python3\lib\subprocess.py", line 775, in __init__
    restore_signals, start_new_session)
  File "c:\python3\lib\subprocess.py", line 1178, in _execute_child
    startupinfo)
FileNotFoundError: [WinError 2] The system cannot find the file specified

[kevin-bates]

@yli110-stat697 - I think the most useful diagnostic for the permission-denied issue is to see if the user SID (in your case, for user ECHO\yli) is getting resolved or if a raw SID is displayed via the Security tab as shown in this comment.

If you see a raw SID, then I suspect you'd need to perform the code modification in c:\python3\lib\site-packages\jupyter_client\connect.py that uses win32api.GetUserNameEx(win32api.NameSamCompatible).

Per the last comment (that came in while typing this response), you must have done something wrong. This issue is more about the file referenced in the argv stanza of the kernelspec's kernel.json file is no longer present. This is completely unrelated, so I would recommend back-tracking your recent steps since updating the connect.py file should have nothing to do with that.

[yli110-stat697]

@kevin-bates Hey I followed this comment

https://github.com/jupyter/notebook/issues/4907#issuecomment-537479889

and did perform the code modification in the correct locations of connec.py, that's why I got the FileNotFoundError. After I changed back the code to be win32api.GetUserName(), the same old permission error came back.

For the SID checkup, please see my screenshot below.

Seems like Yli.ECHO is not given the permission? How do I give a new user permission in this case?

[kevin-bates]

Hmm. I don't really see how the "file not found" was related to the code change to use GetUserNameEx with the parameter since the creation of the connect file (where that code is used) happens before the Popen call that is producing "FileNotFound". Perhaps your pywin32 doesn't have the symbols needed in connect.py, but I would have thought the connection file creation would have failed - so this is strange.

I recommend you do one of three things...

1. See if you're using the appropriate pywin32 (I think you want 224 but that's a whole other mess) that contains the definitions for GetUserNameEx and NameSamCompatible, then apply the code change to connect.py again.
2. Revert jupyter_client back to 5.3.1
3. Wait for the official fix to be released (probably a new version of jupyter_client and jupyter_core).

Given your user SID is resolving, this may even be something else. My hunch is that use of NameSamCompatible may be the thing that changes YLI8059C\YLi to ECHO\YLi and ECHO\YLi truly represents the current user that is running Notebook.

If I had access to a Windows server, I could poke around, but I don't (nor would I like to :smile:).

[yli110-stat697]

@kevin-bates I know! Right? I personally use a Mac and my old company uses Mac, that's why it's driving me nuts when I found my new company is on windows...... I can run jupyter notebook on WSL though, it's just a mystery that I really want to solve why my native system don't have permission but subsystem does :)

Anyway thank you so much for help, I will try your above suggestions. 👍