Jupyter permission error

[thomasbtf]

Person 1 has initiated the first run of the workflow. The Nbconvert (Jupyter Notebook) template has S permissions for/from it. Others who start the workflow cannot use this template, and the error below occurs.

Permission of .snakemake/conda/04ed4593/share/jupyter/nbconvert/templates/html:
drwx--S--- 2 alex covidseq 4.0K Feb 9 22:56 html

Error:
PermissionError: [Errno 13] Permission denied: '/.snakemake/conda/04ed4593/share/jupyter/nbconvert/templates/html/conf.json'

Possible solution: Usage of scripts instead of notebooks.

[thomasbtf]

Temp fix: chmod 2775 .snakemake/conda/04ed4593/share/jupyter/nbconvert/templates/html

[johanneskoester]

@mbargull can you have a look at this? It seems like the nbconvert package writes into its own installation directory during runtime, adding folders into the template directory. Am I right? I would consider this a problem for a conda package. Maybe it can be configured differently?

[mbargull]

jupyter/nbconvert#1028
introduced
https://github.com/jupyter/nbconvert/blame/6.0.7/nbconvert/exporters/templateexporter.py#L545
which is used on the reported nbconvert/templates/html (sub) path.

It ignores the set umask and uses 0o700 (no read/write/execute for group or others) unconditionally.
Also, it is not only the environment's path (given by
https://github.com/jupyter/jupyter_core/blob/4.7.1/jupyter_core/paths.py#L164
and
https://github.com/jupyter/jupyter_core/blob/4.7.1/jupyter_core/paths.py#L132
) that might be created that way but also ones in ~/.local/share (which is the only one that's fine) and, if you run as the root user you might also get unreadable system-wide folders due to
https://github.com/jupyter/jupyter_core/blob/4.7.1/jupyter_core/paths.py#L127-L130
.

---

Long story short: Upstream nbconvert should remove that ensure_dir_exists(path, mode=0o700) (and, if needed, replace it by something else which does not use fixed mode) for paths coming from jupyter_core.paths.jupyter_path.

---

However, I don't know why the environment's path has been used in the case reported by @thomasbtf. Going by the logic from
https://github.com/jupyter/jupyter_core/blob/4.7.1/jupyter_core/paths.py#L127-L130
this would happen JUPYTER_PATH is explicitly set to that path or JUPYTER_PREFER_ENV_PATH is set. Maybe the user's ~/.local/share/jupyter/nbconvert/templates/html directory wasn't writeable and the environment's path was used as a fallback?

I can't tell, unfortunately.
(Partially because the workflow didn't finish locally and I got these errors:

[Wed Feb 24 17:58:32 2021]
rule plot_strains_pangolin:
    input: results/tables/strain-calls/a.strains.pangolin.csv
    output: results/plots/strain-calls/a.strains.pangolin.svg
    log: logs/plot-strains-pangolin/a.log
    jobid: 103
    wildcards: sample=a

[Wed Feb 24 17:58:32 2021]
Error in rule plot_strains_pangolin:
    jobid: 103
    output: results/plots/strain-calls/a.strains.pangolin.svg
    log: logs/plot-strains-pangolin/a.log (check log file(s) for error message)
    conda-env: /home/u1/snakemake-workflow-sars-cov2/.snakemake/conda/9421407d

RuleException:
ImportError in line 149 of /home/u1/snakemake-workflow-sars-cov2/workflow/rules/strain_calling.smk:
cannot import name 'Application' from partially initialized module 'traitlets.config' (most likely due to a circular import) (/opt/conda/envs/x/lib/python3.9/site-packages/traitlets/config/__init__.py)
  File "/opt/conda/envs/x/lib/python3.9/site-packages/snakemake/executors/__init__.py", line 2326, in run_wrapper
  File "/home/u1/snakemake-workflow-sars-cov2/workflow/rules/strain_calling.smk", line 149, in __rule_plot_strains_pangolin
  File "/opt/conda/envs/x/lib/python3.9/site-packages/nbformat/__init__.py", line 109, in writes
  File "/opt/conda/envs/x/lib/python3.9/site-packages/traitlets/log.py", line 19, in get_logger
  File "/opt/conda/envs/x/lib/python3.9/site-packages/snakemake/executors/__init__.py", line 568, in _callback
  File "/opt/conda/envs/x/lib/python3.9/concurrent/futures/thread.py", line 52, in run
  File "/opt/conda/envs/x/lib/python3.9/site-packages/snakemake/executors/__init__.py", line 554, in cached_or_run
  File "/opt/conda/envs/x/lib/python3.9/site-packages/snakemake/executors/__init__.py", line 2357, in run_wrapper
[Wed Feb 24 17:58:32 2021]
Finished job 104.
61 of 67 steps (91%) done
Activating conda environment: /home/u1/snakemake-workflow-sars-cov2/.snakemake/conda/f30b4daa
Activating conda environment: /home/u1/snakemake-workflow-sars-cov2/.snakemake/conda/9421407d
[Wed Feb 24 17:58:35 2021]
Finished job 18.
62 of 67 steps (93%) done
[NbConvertApp] ERROR | Notebook JSON is invalid: Additional properties are not allowed ('id' was unexpected)

Failed validating 'additionalProperties' in code_cell:

On instance['cells'][0]:
{'cell_type': 'code',
 'execution_count': None,
 'id': 'attempted-colony',
 'metadata': {'tags': ['snakemake-job-properties']},
 'outputs': ['...0 outputs...'],
 'source': '\n'
           '######## snakemake preamble start (automatically inserted, do '
           'n...'}
[Wed Feb 24 17:58:40 2021]
Finished job 54.
63 of 67 steps (94%) done
Shutting down, this might take some time.
Exiting because a job execution failed. Look above for error message
Complete log: /home/u1/snakemake-workflow-sars-cov2/.snakemake/log/2021-02-24T174641.019759.snakemake.log

(I also got a SSL cert error midway and restarted the workflow after replacing defaults::ca-certificates with conda-forge::ca-certificates in Snakemakes' environment -- I'm not sure if that was just a fluke or not.)

)

[mbargull]

Maybe it can be configured differently?

Until the issue is fixed upstream, maybe you can try to set the JUPYTER_PATH environment variable to a path the workflow created beforehand (with a mode less strict than 0o700).

[mbargull]

https://github.com/jupyter/nbconvert/issues?q=TemplateExporter+PermissionError
shows similar issues regarding multi-user and concerning the same files.
But those issues aren't very terse, so TL;DR on my part for today :/.

[SylvainCorlay]

We just merged #39 which may fix this issue.

I would be interested in knowing if this improves the situation for you.

[SylvainCorlay]

It may be required for you to acctually remove the conda/04ed4593/share/jupyter/nbconvert/templates/html/ directory.