RStudio Server breaks when TMPDIR/TMP/TEMP is set for an end user

[chgreer]

We have RStudio Server Community Edition 2023.12.0 Build 369 installed on a RHEL 8 server. The default temp directory /tmp is set as noexec for security purposes. When running, for example, install.packages('odbc') , we get the error ERROR: 'configure' exists but is not executable -- see the 'R Installation and Administration Manual'.

Rstudio is run as a special rstudio-server user. End users access it via a webpage. We are trying to install packages to the user-level library where the user should have access to.

The workaround seems to be to change the tempdir() directory via a .Renviron file. When .Renviron is set up with the same entry for TMP, TMPDIR, and TEMP, the command line R used in RStudio (from file.path(R.home("bin"), "R"), which points to /usr/lib64/R/bin/R in our case) on a per-user basis, I can install the odbc package just fine.

However, RStudio seems to break in multiple ways that renders it unusable with the same .Renviron file. A few examples:

1. installed.packages() returns the error:

Error in gzfile(file, mode) : cannot open the connection
In addition: Warning message:
In gzfile(file, mode) :
  cannot open compressed file '/path/to/new/tmp/RtmpBaLpdz/libloc_208_2bf8ab8517f0e8c3.rds', probable reason 'Permission denied'

Despite the fact that the path to the tmp file is user readable/writable/executable.

2. help(tempfile) opens up the 'Help' pane in RStudio, but shows an Internal Server Error message. It works fine with the default TMP values set.

Restarting rstudio does not help. As mentioned above, I can install the packages with the non-standard tempdir environment variables using the command-line R. If, after installation on the command line, I remove the .Renviron file so that RStudio works correctly, I can see the odbc package in the list of packages in RStudio, but trying to load the package gives an error R/x86_64-redhat-linux-gnu-library/4.3/rlang/libs/rlang.so: failed to map segment from shared object.

I have seen a lot of discussion about this tempdir issue, but nothing pertaining to my individual setting. Apologies if I've missed something.

Since we're on the community server, the ability to use /etc/rstudio/rsession-profile seems to be out of reach. Should we change the .bashrc for the rstudio-server user? After that, I'm fresh out of ideas.

Since the command-line R seems to work, this seems to be specific to the RStudio install.

Thanks for any help.

[chgreer]

An update.

We've got it almost working with two things:

1. Set SELinux to 'Permissive'.

2. Set the value of the TMP directory to be a directory with executable privileges in Renviron.site for the version of R currently installed.

The other issues I mentioned above (installed.packages() failing and help failing in RStudio) are gone and we can install packages in RStudio as well as the CLI R.

The goal is eventually to have SELinux set to enforcing. When set to enforcing with the above setup, the login hangs with a popup Could not connect to the R session on RStudio Server.\n\nError occurred during transmission (6). with the following in the logs:

2024-02-22T18:32:36.690813Z [rserver] DEBUG -- rpc error: other error for: /rpc/client_init (166281:58) in 8.844s error: asio.misc error 2 (End of file)

Will post if I find an update for an update getting SELinux back to enforcing.

[GaryR]

A (long) issue discussing various issues using RStudio with SELinux.

Support SELinux via configurations and documentation