[BUG] Sandbox failing with Python 3.8

[mariajgrimaldi]

Description

The codejailservice fails to execute code when using Python 3.8 in the secure sandbox.

To Reproduce

Steps to reproduce the behavior:

1. Install tutor, tutor-contrib-codejail, codejailservice from source
2. Move to nutmeg branches: nutmeg -for tutor-, 14.0.0 -for codejailservice-, MJG/nutmeg -for tutor-contrib-codejail-
3. Install plugin
4. Build images: tutor config save && tutor images build all
5. Init services: tutor dev init
6. Follow test instructions here. The error will appear in the course component.
   Further testing:
7. Enter container: tutor dev dc run codejailservice bash
8. Activate environment: source /sandbox/venv/bin/activate
9. Run python, the same error will appear

Expected behavior

A clear and concise description of what you expected to happen.

Additional context

We encountered this error while giving nutmeg support to the plugin. First, trying to use a Python Evaluated component in a course:

After entering the codejailservice container to inspect contents, we found that running python using the sandbox virtualenv failed:

With the same error as the course component. Then, we ran the same command but without the docker-compose files:

And it worked. So it must be something in the docker-compose configurations. After removing this line, the command worked with the docker-compose files. So what's going on with the apparmor profile & python3.8? 🤔
For reference, here is the appamor profile defined by this plugin.

[kdmccormick]

Hey @jmbowman, did you folks see an error of this sort when upgrading edx.org's edx-sandbox environment to Python 3.8?

[regisb]

A quick search (my specialty) yielded this: https://stackoverflow.com/questions/65184937/fatal-python-error-init-fs-encoding-failed-to-get-the-python-codec-of-the-file
Could it all have to do with the PYTHONHOME environment variable? (full disclaimer: I don't know what I'm talking about)

(now that was a silly idea)

[jmbowman]

My first suspicion would be some sort of mismatch with either the Python version set up in the apparmor configuration or the name of the binary being executed, but Ned might have a better idea; I'll point him here. Also note that we figured out a way to test codejail with apparmor enforced in GitHub Actions, something like that may be useful for CI here also: https://github.com/openedx/codejail/blob/master/.github/workflows/ci.yml .

[nedbat]

I don't remember an error like this, but "encodings" I think is the first module imported from the file system, after a few modules imported from frozen modules. Do all of the directories mentioned in the configuration exist? You could try adding "-vv" to the Python command line to see all the import activity, which might have some clues.

[regisb]

I believe I found the problem: this line was not upgraded to 3.8.5

tutor-contrib-codejail/tutorcodejail/templates/codejail/apps/profiles/docker-edx-sandbox

Line 55 in c9d0027

/opt/pyenv/versions/3.5.10/** mr,

On my machine, after I modify this line and reload the apparmor profile (with tutor dev init --limit=codejail) I am able to run the python binary from the sandbox venv. You may have to manually delete the existing profile before applying the new one, though.

[mariajgrimaldi]

Thank you for the help! Really appreciated! @nedbat @jmbowman @regisb @kdmccormick 😀

I finally got this working! Regis was totally right! I totally missed that line. Thank you so much. I'm closing this issue now.

[Abdess]

The bug seems to be back on Nutmeg (Tutor 14.0.4) with the latest plugin (ce71496) 😅

[mariajgrimaldi]

Hello @Abdess! Can you try removing the app armor profile & creating it again with the nutmeg version of this plugin?

[Abdess]

Hello @mariajgrimaldi! :)
The error persists. 🤔

In case of doubt, you are talking about this file, right?

[mariajgrimaldi]

Yes! @Abdess, I was referring to the profile created using that file. Can you list how did you get to that error? To see if I can reproduce it. Thanks (include all possible details) 😄

[Abdess]

Yes! @Abdess, I was referring to the profile created using that file. Can you list how did you get to that error? To see if I can reproduce it. Thanks (include all possible details) 😄

For the details, it will be relatively short, because I just followed the README. 😅

I use Tutor 14.0.4 with Nutmeg.

Here are the steps performed:

• pip install git+https://github.com/edunext/tutor-contrib-codejail
• tutor plugins enable codejail
• tutor config save
• tutor local init --limit=codejail
• tutor local quickstart
• Test with course_codejail_example.tar.gz

• error

I stay available to answer all your questions.

[mariajgrimaldi]

Thanks again @Abdess; I have a few questions:

1. Was this the first time you installed this plugin & created the app armor profile?
2. Did you remove the app armor profile and add it again?

This might again have something to do with the current profile you're using.

[Abdess]

You're welcome @mariajgrimaldi; To answer the questions:

1. Yes, it was a fresh install.
2. Yes, one interesting thing is that there was no difference between the 2 files.

I stay tuned if you have any manipulations to suggest.