DeployR Open - Restrict file system access - r

According to the DeployR documentation each session is locked down:
"By default, R sessions executing on the DeployR grid are not authorized to access files or directories outside of the R working directory"
However, I have been able to upload a simple script using a user that has Basic_User role and that reads a file from the c:\ drive on windows.
t <- read.table("C:\\MyFile.csv")
t
How do you lock down access to the file system? I seem to have missed something.

Related

macOS Catalina + Xcode 11 Error on reading file from project

After upgrading to macOS Catalina with latest Xcode 11, I am not able to read files directly from user path when doing unit testing, example:
PROJECT_DIR + "/FolderX/myFile.json",
I keep getting error Thread 1: EXC_BAD_ACCESS (code=1, address=0x8)
This is also happened when I am trying to open a couchbase lite database with custom path.
Error:
error opening!: 14
Cannot open database, Error : Error Domain=SQLite Code=14 "unable to open database file" UserInfo={NSLocalizedDescription=unable to open database file}
I believe this is an issue due to the read write access between my simulator and the latest Catalina.
My current workaround is to add my files and database to target membership and read the files directly from [NSBundle bundleForClass:[self class]].bundlePath.
Is there any better fix to this? Like tweaking any setting to allow it to read files from custom path like in older versions?
You might try looking in SystemPreferences > Security&Privacy > Privacy tab. From there, scroll down to "Files and Folders" <-- There's where you can see programs and the folders they have been granted access to in Catalina.
Personally, I didn't have time to waste figuring out how the new file permissions are supposed to work, so I let Xcode have full disk permission. (Right above the "files and folders" is "Full Disk Access".
Of course, that solved all my issues... after I get a chance to play with the new file permissions, I may revoke that access and give it explicit folder access.
Well if anyone is still struggling with this, I've moved all my projects outside of ~/Documents/
it is strange that projects under ~/Documents/ doesnt get asked for read permission, other paths do!
I end up putting all my projects under ~/workspace/
** for those who doesnt know, ~/ means /Users/{your username}/
Check your File Access settings in the App Sandbox in your project's settings, under Signing and Capabilities. For example, I couldn't access files in /Users/Bert/Downloads, even after turning on Full Disk Access in Security and Privacy in System Preferences. I had to grant read access to the Downloads Folder in App Sandbox settings.

Tableau Linux server, does it not recognize the user ODBC settings

Connecting data source via ODBC driver to the tableau server seem to not work at a user level.
I have odbc.ini and obdcinst.ini files on the user home directory. $ODBCINI and $ODBCINSTINI Environment variables are set pointing to respective files.Tableau still fail to pick the data source.
Workbook published from the desktop is rendered only on placing the odbc.ini and odbcinst.ini into /etc/ or tableau user directory (/var/opt/tableau/tableau_server/).
Although it fixes the issue, there are multiple users on the system and we do not want to configure at a system level affecting all the users.
https://community.tableau.com/docs/DOC-17674 suggests to configure ODBCSYSINI in /etc/systemd/system/tabsvc_0.service. The latest version of tableau (2018.3) seem to have the conf file at /var/opt/tableau/tableau_server/.local/share/systemd/user/tabsvc_0.service. How can we configure it to use the settings for each user and restart this service?

how to unload from DBserver without using its OS to a remote server

I have a problem in oracle database. I am having a database on which a service is hosted and hence I am not able to see the drives or folders of oracle database. Hence, the procedures using utl_file have stopped working as directory path is invalid now.
How will I read and write on OS file system ? I need to pull out reports from joining 2-3 tables of oracle and pull data out in flat file. where as external tables, and utl_file cannot work as directory path cannot be defined due to hosting layer the oracle OS layer is invisible.
Also, mounting of database is also not permitted and privileges to create directory is also not given.
Could you pleas , please help me. Thanks.
If you have sysdba privileges on the box, do something along the following lines:
SQL> CREATE DIRECTORY log_dir AS '/appl/gl/log';
SQL> GRANT READ ON DIRECTORY log_dir TO DBA;
SQL> GRANT WRITE ON DIRECTORY log_dir TO DBA;
If you do not have these privileges, then ask the hosting company to do it. In addition you can always write a report file with sqlplus on your local drive.

Change SQLite database mode to read-write

How can I change an SQLite database from read-only to read-write?
When I executed the update statement, I always got:
SQL error: attempt to write a readonly database
The SQLite file is a writeable file on the filesystem.
There can be several reasons for this error message:
Several processes have the database open at the same time (see the FAQ).
There is a plugin to compress and encrypt the database. It doesn't allow to modify the DB.
Lastly, another FAQ says: "Make sure that the directory containing the database file is also writable to the user executing the CGI script." I think this is because the engine needs to create more files in the directory.
The whole filesystem might be read only, for example after a crash.
On Unix systems, another process can replace the whole file.
I solved this by changing owner from "root" to my own user, on all files in Database's folder.
Just do ls -l on said folder, and if any of the files is owned by root, just change it to your user, like:
# For each file do:
sudo chown "$USER":"$USER" /path/to/my-folder/file.txt
# Or "R"ecursive.
sudo chown -R "$USER":"$USER" /path/to/my-folder
(this error message is typically misleading, and is usually a general permissions error)
On Windows
If you're issuing SQL directly against the database, make sure whatever application you're using to run the SQL is running as administrator
If an application is attempting the update, the account that it uses to access the database may need permissions on the folder containing your database file. For example, if IIS is accessing the database, the IUSR and IIS_IUSRS may both need appropriate permissions (you can try this by temporarily giving these accounts full control over the folder, checking if this works, then tying down the permissions as appropriate)
This error usually happens when your database is accessed by one application already, and you're trying to access it with another application.
To share personal experience I encountered with this error that eventually fix both. Might not necessarily be related to your issue but it appears this error is so generic that it can be attributed to gazillion things.
Database instance open in another application. My DB appeared to have been in a "locked" state so it transition to read only mode. I was able to track it down by stopping the a 2nd instance of the application sharing the DB.
Directory tree permission - please be sure to ensure user account has permission not just at the file level but at the entire upper directory level all the way to / level.
Thanks
If using Android.
Make sure you have added the permission to write to your EXTERNAL_STORAGE to your AndroidManifest.xml.
Add this line to your AndroidManifest.xml file above and outside your <application> tag.
<uses-permission android:name="android.permission.WRITE_EXTERNAL_STORAGE"/>
This will allow your application to write to the sdcard. This will help if your EXTERNAL_STORAGE is where you have stored your database on the device.
On win10 after a system crash, try to open db with DB Browser, but read only.
Simply delete the journal file.
In Linux command shell, I did:
chmod 777 <db_folder>
Where contains the database file.
It works. Now I can access my database and make insert queries.
On Windows:
tl;dr: Try opening the file again.
Our system was suffering this problem, and it definitely wasn't a permissions issue, since the program itself would be able to open the database as writable from many threads most of the time, but occasionally (only on Windows, not on OSX), a thread would get these errors even though all the other threads in the program were having no difficulties.
We eventually discovered that the threads that were failing were only those that were trying to open the database immediately after another thread had closed it (within 3 ms). We speculated that the problem was due to the fact that Windows (or the sqlite implementation under windows) doesn't always immediately clean up up file resources upon closing of a file. We got around this by running a test write query against the db upon opening (e.g., creating then dropping a table with a silly name). If the create/drop failed, we waited for 50 ms and tried again, repeating until we succeeded or 5 seconds elapsed.
It worked; apparently there just needed to be enough time for the resources to flush out to disk.
On Ubuntu, change the owner to the Apache group and grant the right permissions (no, it's not 777):
sudo chgrp www-data <path to db.sqlite3>
sudo chmod 664 <path to db.sqlite3>
Update
You can set the permissions for group and user as well.
sudo chown www-data:www-data <path to db.sqlite3>
If <db_name>.sqlite-journal file exists in the same folder with DB file, that means your DB is opened currently and in the middle of some changes (or it had been at the moment when DB folder was copied). If you try to open DB at this moment error attempt to write a readonly database (or similar) could appear.
As a solution, wait till <db_name>.sqlite-journal disappears or remove it (is not recommended on the working system)
I had this problem today, too.
It was caused by ActiveSync on Windows Mobile - the folder I was working in was synced so the AS process grabbed the DB file from time to time causing this error.
On Linux, give read/write permissions to the entire folder containing the database file.
Also, SELinux might be blocking the write. You need to set the correct permissions.
In my SELinux Management GUI (on Fedora 19), I checked the box on the line labelled httpd_unified (Unify HTTPD handling of all content files), and I was good to go.
I'm using SQLite on ESP32 and all answers here are "very strange"....
When I look at the data on the flash of the ESP I notice there is only one file for the whole db (there is also a temp file).
In this db file we have of course the user tables but also the system tables so "sqlite_master" for example which contain the definiton of the tables.
So, it's seems hard to belive this can be a "chmod" problem, because if the file is read only, even creating table would be impossible as SQLite would be unable to write the "sqlite_master" data...
So I think our friend user143482 is trying to acesse a "read only" table. In SQLite source code we can see a function named tabIsReadOnly with this comment:
/* Return true if table pTab is read-only.
**
** A table is read-only if any of the following are true:
**
** 1) It is a virtual table and no implementation of the xUpdate method
** has been provided
**
** 2) It is a system table (i.e. sqlite_master), this call is not
** part of a nested parse and writable_schema pragma has not
** been specified
**
** 3) The table is a shadow table, the database connection is in
** defensive mode, and the current sqlite3_prepare()
** is for a top-level SQL statement.
*/

Does Adobe Air have unconstrained file system access?

I've found several examples and documentation that show how to read and write files on the system, but all show user intervention or reading/writing files in user profile directories. There are a few things I want to do:
Monitor system and other application log files for changes, then automatically load those files when changes occur
Reload a previously open file when the application launches
Write files into a log directory, which probably will not exist in the same path as the application.
In my very quick search, it seems that there may be a security model that constrains an AIR application's access to the file system, so that files can only be read or written to directories selected by the user with the file system dialog OR files can be written within the user profile or air application directory.
Does an Adobe Air application have unconstrained access to the file system?
AIR has exactly the same access to the file system as the current User. If you are admin on your computer, AIR har full access to all files. If you are a restricted user, AIR has restricted access.
One thing to be mindful of is that if you load swf:s from the AIR app's home directory, it will be run in the Application sandbox. If you read it from outside, it will be executed within a File sandbox which is essentially the same as loading from the web.
Some comments on your list:
1 Monitor system and other application log files for changes, then automatically load those files when changes occur
As far as I know, AIR cannot monitor the file system. You will have to poll this regularly.
2 Reload a previously open file when the application launches
Save this info in a file or SQLite and check it when the app starts.
3 Write files into a log directory, which probably will not exist in the same path as the application.
The main thing to remember is to use the file path abstractions in AIR rather than OS specific paths such as c:/
I would say your answer depends on the platform. I'm sure that Adobe Air does not automatically have root access on OS X, so it would not be able to read, write and execute in cases where whatever owner started the AIR app did not have the right permissions for accessing a file. In short, you probably have the same privileges any other program running on the computer might have that was installed by the same user.
More information here:
http://help.adobe.com/en_US/AIR/1.5/devappshtml/WS5b3ccc516d4fbf351e63e3d118666ade46-7f05.html#WS5b3ccc516d4fbf351e63e3d118666ade46-7e35

Resources