IOError: file() constructor not accessible in restricted mode

[thomas.thorne]

I am not exactly sure what causes this problem. It seems to be intermittent with it sometimes not happening at all for several days. There are only a handful of people using this Trac instance though.

It seems that the Browse source tab vanishes from the list when this problem message pops up.

We upgraded from Trac 0.11 a couple of months ago. I am not sure if the problem started immediately or not. I do not remember seeing it in the past. The other recent change was the addition of an SVN repository a few weeks ago. Previously we had only had a couple of Git repositories linked in.

How to Reproduce

While doing a GET operation on /search, Trac issued an internal error.

(please provide additional details here)

Request parameters:

{u'q': u'jenkins'}

User agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36

System Information

Trac	1.0.9
Babel	2.1.1
Docutils	0.12
Genshi	0.7 (without speedups)
GIT	2.7.1
mod_wsgi	3.4 (WSGIProcessGroup WSGIApplicationGroup trac.pt.local|/trac)
psycopg2	2.6.1
Pygments	2.0.2
Python	2.7.6 (default, Jun 22 2015, 18:01:27) [GCC 4.8.2]
pytz	2015.7
RPC	1.1.5
setuptools	18.8.1
Subversion	1.8.8 (r1568071)
jQuery	1.7.2
jQuery UI	1.8.21
jQuery Timepicker	1.0.1

Enabled Plugins

HudsonTrac	0.5.post0
TracAccountManager	0.4.4
TracExtractUrl	0.3
TracIniAdminPanel	1.0.1
TracServerSideRedirectPlugin	1.0.0
TracXMLRPC	1.1.5

Python Traceback

Traceback (most recent call last):
  File "/usr/local/lib/python2.7/dist-packages/trac/web/main.py", line 554, in _dispatch_request
    dispatcher.dispatch(req)
  File "/usr/local/lib/python2.7/dist-packages/trac/web/main.py", line 247, in dispatch
    resp = chosen_handler.process_request(req)
  File "/usr/local/lib/python2.7/dist-packages/trac/search/web_ui.py", line 105, in process_request
    results = self._do_search(req, terms, filters)
  File "/usr/local/lib/python2.7/dist-packages/trac/search/web_ui.py", line 213, in _do_search
    or [])
  File "/usr/local/lib/python2.7/dist-packages/trac/versioncontrol/web_ui/changeset.py", line 1134, in get_search_results
    for repos in rm.get_real_repositories())
  File "/usr/local/lib/python2.7/dist-packages/trac/versioncontrol/api.py", line 664, in get_real_repositories
    repos = self.get_repository(reponame)
  File "/usr/local/lib/python2.7/dist-packages/trac/versioncontrol/api.py", line 604, in get_repository
    repoinfo.copy())
  File "/usr/local/lib/python2.7/dist-packages/tracopt/versioncontrol/svn/svn_fs.py", line 335, in get_repository
    repos = SubversionRepository(dir, params, self.log)
  File "/usr/local/lib/python2.7/dist-packages/tracopt/versioncontrol/svn/svn_fs.py", line 348, in __init__
    self.pool = Pool()
  File "/usr/local/lib/python2.7/dist-packages/tracopt/versioncontrol/svn/svn_fs.py", line 170, in __init__
    self._pool = core.svn_pool_create(self._parent_pool())
  File "/usr/lib/python2.7/dist-packages/svn/core.py", line 305, in svn_pool_create
    return Pool(parent_pool)
  File "/usr/lib/python2.7/dist-packages/libsvn/core.py", line 1625, in svn_pool_create
    return _core.svn_pool_create(*args)
  File "/usr/lib/python2.7/dist-packages/libsvn/core.py", line 6654, in _wrap
    obj.set_parent_pool(self)
  File "/usr/lib/python2.7/dist-packages/libsvn/core.py", line 6564, in set_parent_pool
    traceback.print_stack(file=open('/tmp/libsvn-%d.log' % os.getpid(), 'a'))
IOError: file() constructor not accessible in restricted mode

[Thomas.Thorne@…]

Adding a comment with my email address so that I can get notifications. I should have set that before I hit submit.

[Christian Boos]

Please read ​Multiple Python Sub Interpreters in the mod_wsgi doc.

It looks like you're using psycopg2, so you may experience the problem mentioned there. Upgrading to a more recent version may fix it.

In any case, we advise that you don't use sub-interpreters, so better set WSGIApplicationGroup %{GLOBAL} (looks like you have WSGIApplicationGroup trac.pt.local|/trac). If you can't do that, last possibility is to use the daemon mode of mod_wsgi.

Duplicate of #3371.

[Thomas.Thorne@…]

psycopg2 seems to be the latest version available according to: ​http://initd.org/psycopg/ At any rate I am running with whatever the Unbuntu LTS supplies. I would be uncomfortable changing that on a production server without exploring other options first.

Thank you for the linked information and the suggested work around. I will try setting WSGIApplicationGroup %{GLOBAL} as you advise and report back on how things go.

[Thomas.Thorne@…]

It looks like I have tried to do as requested but if you are saying the setting is not for %{GLOBAL} then I must have set things incorrectly:

$ sudo rgrep 'WSGIApplicationGroup'
apache2/sites-available/trac.conf:    WSGIApplicationGroup %{GLOBAL}
apache2/sites-available/trac.conf:    WSGIApplicationGroup %{GLOBAL}

It looks like the setting needs to go in the virtual host configuration, based on some search hits. My apache2.conf does not have a virtual host set in it, only directories and trac.conf is the same. Ah there is a /etc/apache2.conf/sites-enabled/000-default.conf file that includes one. I will try setting it there, restarting Apache and see what the behaviour is like over the next couple of weeks.

[Christian Boos]

Replying to Thomas.Thorne@…:

It looks like I have tried to do as requested but if you are saying the setting is not for %{GLOBAL} then I must have set things incorrectly:

You will know when you have set it correctly when you'll see the following below the System Information section in the /about page (as admin):

mod_wsgi	3.4 (WSGIProcessGroup WSGIApplicationGroup %{GLOBAL})