Merge pull request #1159 from edx/feanil/sandbox_matplotlib

Make changes need for matplotlib to work in the code sandbox.

playbooks/roles/edxapp/defaults/main.yml

@@ -290,10 +290,10 @@ EDXAPP_FILE_UPLOAD_STORAGE_PREFIX: 'submissions_attachments'
 
 EDXAPP_CODE_JAIL_LIMITS:
   # Limit the memory of the jailed process to something high but not
-  # infinite (128MiB in bytes)
-  VMEM: 134217728
+  # infinite (512MiB in bytes)
+  VMEM: 536870912
   # Time in seconds that the jailed process has to run.
-  REALTIME: 1
+  REALTIME: 3
   # Needs to be non-zero so that jailed code can use it as their temp directory.(1MiB in bytes)
   FSIZE: 1048576
 

playbooks/roles/edxapp/tasks/main.yml

@@ -81,7 +81,7 @@
   with_items: service_variants_enabled
 
 # Set up the python sandbox execution environment
-- include: python_sandbox_env.yml
+- include: python_sandbox_env.yml tags=deploy
   when: EDXAPP_PYTHON_SANDBOX
 
 - include: deploy.yml tags=deploy

playbooks/roles/edxapp/tasks/python_sandbox_env.yml

+# Set the alternatives this way for blas and lapack to work correctly for the 
+# MITx 6.341x course.
+# TODO: Switch to using alternatives module in 1.6
+- name: code sandbox | Use libblas for 3gf
+  command: update-alternatives --set libblas.so.3gf /usr/lib/libblas/libblas.so.3gf
+
+# TODO: Switch to using alternatives module in 1.6
+- name: code sandbox | Use liblapac for 3gf
+  command: update-alternatives --set liblapack.so.3gf /usr/lib/lapack/liblapack.so.3gf
+
 - name: code sandbox | Create edxapp sandbox user
   user: name={{ edxapp_sandbox_user }} shell=/bin/false home={{ edxapp_sandbox_venv_dir }}
   notify:

playbooks/roles/edxapp/tasks/xml.yml

+- name: make the course data updatable by the edxapp user
+  file:
+    path="{{ edxapp_course_data_dir }}"
+    state=directory
+    recurse=yes
+    owner="{{ edxapp_user }}"
+    group="{{ edxapp_user }}"
+
 - name: clone the xml course repo
   git: >
     repo="{{ item.repo_url }}"

playbooks/roles/edxapp/templates/code.sandbox.j2

@@ -9,7 +9,7 @@
     /tmp/codejail-*/** wrix,
 
     #
-    # Whitelist particiclar shared objects from the system
+    # Whitelist particular shared objects from the system
     # python installation
     #
     /usr/lib/python2.7/lib-dynload/_json.so mr,
@@ -21,6 +21,22 @@
     /usr/lib/python2.7/lib-dynload/_elementtree.so mr,
     /usr/lib/python2.7/lib-dynload/pyexpat.so mr,
 
+    # Matplot lib  needs a place for temp caches
+    {{ edxapp_sandbox_venv_dir }}/.config/ wrix,
+    {{ edxapp_sandbox_venv_dir }}/.cache/ wrix,
+    {{ edxapp_sandbox_venv_dir }}/.config/** wrix,
+    {{ edxapp_sandbox_venv_dir }}/.cache/** wrix,
+
+    # Matplotlib related libraries
+    /usr/lib/python2.7/lib-dynload/termios.so mr,
+    /usr/lib/python2.7/lib-dynload/parser.so mr,
+
+    # Matplot lib needs fonts to make graphs
+    /usr/share/fonts/ r,
+    /usr/share/fonts/** r,
+    /usr/local/share/fonts/ r,
+    /usr/local/share/fonts/** r,
+
     #
     # Allow access to selections from /proc
     #