Problem with rserve on SWISH

[Franco Masotti]

Hello,

I am trying to setup SWISH with Rserve.

The docker part [1] works flawlessly (socket is present in /home/rserve/socket). However I'm missing something in the client part [2] .
What I did was to add
    :- use_module(lib/r_swish).
to run.pl [3] just below
    :- use_module(server).
Now, when I go in the query section and type the following:
    <- 'R.Version'().

I get:
"
No permission to call sandboxed `r_assign_(_1092 [...]
Reachable from:
[...]
"

Without adding the previous line to run.pl I get a syntax error, so I think I'm on the right track.

In the readme file of rserve_client two ways are indicated:
"
Now, R is not safe. You should either run Rserve in a tight OS container and load library(r/r_sandbox) or run SWISH in authenticated mode by loading lib/authenticate.pl.
"

I'm interested in the first one: run Rserve in a tight OS container and load library(r/r_sandbox)

How should this be done?

Thank you.

[1]: <https://github.com/JanWielemaker/rserve-sandbox>
[2]: <https://github.com/JanWielemaker/rserve_client>
[3]: <https://github.com/SWI-Prolog/swish/blob/master/run.pl>

[Jan Wielemaker]

On 10/13/16 17:45, Franco Masotti wrote:
> Hello,
>
> I am trying to setup SWISH with Rserve.
>
> The docker part [1] works flawlessly (socket is present in
> /home/rserve/socket). However I'm missing something in the client part [2] .
> What I did was to add
> :- use_module(lib/r_swish).
> to run.pl [3] just below
> :- use_module(server).
> Now, when I go in the query section and type the following:
> <- 'R.Version'().
>
> I get:
> "
> No permission to call sandboxed `r_assign_(_1092 [...]
> Reachable from:
> [...]
> "
>
> Without adding the previous line to run.pl I get a syntax error, so I
> think I'm on the right track.
>
> In the readme file of rserve_client two ways are indicated:
> "
> Now, R is not safe. You should either run Rserve in a tight OS container
> and load |library(r/r_sandbox)| or run SWISH in authenticated mode by
> loading |lib/authenticate.pl.|
> "
>
> I'm interested in the first one: run Rserve in a tight OS container and
> load |library(r/r_sandbox)
> |
> How should this be done?

Just as it says: add :- use_module(library(r/r_sandbox)).

Cheers --- Jan

>
> Thank you.
>
> [1]: <https://github.com/JanWielemaker/rserve-sandbox>
> [2]: <https://github.com/JanWielemaker/rserve_client>
> [3]: <https://github.com/SWI-Prolog/swish/blob/master/run.pl>
>

> --
> You received this message because you are subscribed to the Google
> Groups "SWI-Prolog" group.
> To unsubscribe from this group and stop receiving emails from it, send
> an email to swi-prolog+...@googlegroups.com
> <mailto:swi-prolog+...@googlegroups.com>.
> Visit this group at https://groups.google.com/group/swi-prolog.
> For more options, visit https://groups.google.com/d/optout.

[Franco Masotti]

Thank you.

Now I get:
"
Unknown error term: sisocks_error(-1,'connection_refused')
"

which seems to be an Rserve problem with the socket (by having a look at the Rserve source code).
Anyway, note that I'm running SWISH as:
swish:swish
user and group. I think there might be some kind of permission problem (since the docker image is up and running)
but I'm not really sure.

Any ideas?

[Jan Wielemaker]

On 10/13/16 19:27, Franco Masotti wrote:
> Thank you.
>
> Now I get:
> "
> Unknown error term: sisocks_error(-1,'connection_refused')
> "
>
> which seems to be an Rserve problem with the socket (by having a look at
> the Rserve source code).
> Anyway, note that I'm running SWISH as:
> swish:swish
> user and group. I think there might be some kind of permission problem
> (since the docker image is up and running)
> but I'm not really sure.
>
> Any ideas?

This is indeed a permission issue. The connecting Prolog process must
be member
of the rserve group (if I recall the group name correctly). Use
`groups` to verify
the group membership.

Cheers --- Jan

>
> On Thursday, 13 October 2016 17:45:02 UTC+2, Franco Masotti wrote:
>
> Hello,
>
> I am trying to setup SWISH with Rserve.
>
> The docker part [1] works flawlessly (socket is present in
> /home/rserve/socket). However I'm missing something in the client
> part [2] .
> What I did was to add
> :- use_module(lib/r_swish).

> to run.pl <http://run.pl> [3] just below

> :- use_module(server).
> Now, when I go in the query section and type the following:
> <- 'R.Version'().
>
> I get:
> "
> No permission to call sandboxed `r_assign_(_1092 [...]
> Reachable from:
> [...]
> "
>

> Without adding the previous line to run.pl <http://run.pl> I get a

> syntax error, so I think I'm on the right track.
>
> In the readme file of rserve_client two ways are indicated:
> "
> Now, R is not safe. You should either run Rserve in a tight OS
> container and load |library(r/r_sandbox)| or run SWISH in
> authenticated mode by loading |lib/authenticate.pl

> <http://authenticate.pl>.|

> "
>
> I'm interested in the first one: run Rserve in a tight OS container
> and load |library(r/r_sandbox)
> |
> How should this be done?
>
> Thank you.
>
> [1]: <https://github.com/JanWielemaker/rserve-sandbox
> <https://github.com/JanWielemaker/rserve-sandbox>>
> [2]: <https://github.com/JanWielemaker/rserve_client
> <https://github.com/JanWielemaker/rserve_client>>
> [3]: <https://github.com/SWI-Prolog/swish/blob/master/run.pl

[Franco Masotti]

# gpasswd -a swish rserve

did the trick.
Thanks a lot.

On Thursday, 13 October 2016 17:45:02 UTC+2, Franco Masotti wrote: