%

Python: virtual environment on OpenBSD

How to use virtuals environments Python on OpenBSD with W^X security.

Details about this article

Article published the
; modified the
2 minutes to read

This article has 397 words.

Uniq IDentifiant: tag:doc.huc.fr.eu.org,2019-06-19:/en/dev/python/env-python-openbsd#f8031a3ebf7e243c1d857cc10d0b044ffc852cf61314335ce412412737aeb1a2


RAW source of the article:
Commit version: 9bf3d7b


This article is also available on Gemini Protocol:
gemini://doc.huc.fr.eu.org/en/dev/python/env-python-openbsd.gmi


Description

  • OS : OpenBSD 6.x

Since OpenBSD 6.0, wxallowed is a mount option, by default on /usr/local.

If the partition has this option, the software is allowed to run from that partition, otherwise it won’t be able to run and will issue a W^X violation message:

:$ dmesg | grep wxallowed
/home/hs/.local/share/virtualenvs/mybeautifullproject-q1koN8ay/bin/python3(26392): W^X binary outside wxallowed mountpoint

In fact, since only /usr/local had this actived option, if you attempt to run one program, by example on your $HOME, this one will not execute.
That’s the whole problem with Python environments that need to work in your home directory.

Here the problem with virtualenv:

:$ virtualenv mybeautifullproject
Using base prefix '/usr/local'
New python executable in $HOME/python/mybeautifullproject.py/mybeautifullproject/bin/python3
Also creating executable in $HOME/python/mybeautifullproject.py/mybeautifullproject/bin/python
ERROR: The executable $HOME/python/mybeautifullproject.py/mybeautifullproject/bin/python3 could not be run: [Errno 13] Permission denied: '$HOME/python/mybeautifullproject.py/mybeautifullproject/bin/python

Egual for pipenv:

:$ pipenv install requests
Warning: the environment variable LANG is not set!
We recommend setting this in ~/.profile (or equivalent) for proper expected behavior.
Creating a virtualenv for this project…
Pipfile: $HOME/python/mybeautifullproject.py/Pipfile
Using /usr/local/bin/python3 (3.6.8) to create virtualenv…
⠇ Creating virtual environment...Already using interpreter /usr/local/bin/python3
Using base prefix '/usr/local'
New python executable in $HOME/.local/share/virtualenvs/mybeautifullproject.py-oFlnu9vD/bin/python3
Also creating executable in $HOME/.local/share/virtualenvs/mybeautifullproject.py-oFlnu9vD/bin/python
ERROR: The executable $HOME/.local/share/virtualenvs/mybeautifullproject.py-oFlnu9vD/bin/python3 could not be run: [Errno 13] Permission denied: '$HOME/.local/share/virtualenvs/mybeautifullproject.py-oFlnu9vD/bin/python3'

✘ Failed creating virtual environment
[pipenv.exceptions.VirtualenvCreationException]:   File "$HOME/.local/lib/python3.6/site-packages/pipenv/cli/command.py", line 254, in install
[pipenv.exceptions.VirtualenvCreationException]:       editable_packages=state.installstate.editables,
[pipenv.exceptions.VirtualenvCreationException]:   File "$HOME/.local/lib/python3.6/site-packages/pipenv/core.py", line 1741, in do_install
[pipenv.exceptions.VirtualenvCreationException]:       pypi_mirror=pypi_mirror,
[pipenv.exceptions.VirtualenvCreationException]:   File "$HOME/.local/lib/python3.6/site-packages/pipenv/core.py", line 574, in ensure_project
[pipenv.exceptions.VirtualenvCreationException]:       pypi_mirror=pypi_mirror,
[pipenv.exceptions.VirtualenvCreationException]:   File "$HOME/.local/lib/python3.6/site-packages/pipenv/core.py", line 506, in ensure_virtualenv
[pipenv.exceptions.VirtualenvCreationException]:       python=python, site_packages=site_packages, pypi_mirror=pypi_mirror
[pipenv.exceptions.VirtualenvCreationException]:   File "$HOME/.local/lib/python3.6/site-packages/pipenv/core.py", line 935, in do_create_virtualenv
[pipenv.exceptions.VirtualenvCreationException]:       extra=[crayons.blue("{0}".format(c.err)),]
[pipenv.exceptions.VirtualenvCreationException]:
Failed to create virtual environment.

Configuration

One only little system change will make our lives easier:

  • create a folder user into /usr/local, i.e.:
    :# mkdir -p /usr/local/${my_user}/python
  • chown user and group rights:
    :# chown -R ${my_user}:wheel /usr/local/${my_user}
  • create symbolic link:
    :# ln -s /usr/local/${my_user}/python $home/python

Of course, replace ${my_user} by your id! ;-)

If you use pipenv, you need to create a new folder and symlink; read the TL;DR below.

TL;DR

Replace ${my_user} by your session id!

⇒ For virtualenv:

:# mkdir -p /usr/local/${my_user}/python
:# chown -R ${my_user}:wheel /usr/local/${my_user}
:# ln -s /usr/local/${my_user}/python $home/python

⇒ For pipenv, you need to add more:

:$ mkdir /usr/local/$USER/python/virtualenvs
:$ ln -s /usr/local/$USER/python/virtualenvs $HOME/.local/share/virtualenvs

Documentations

Aknowledgements

  • This article would not exists without Xavier…
  • and, this other article: “Using cabal on OpenBSD”



Enjoy-ID!
Enjoy-IT!