Config setting to disallow `run_on_scheduler`

We run an adaptive deployment wherein the dask Scheduler runs in an environment with elevated permissions compared with the workers. Consequently, we’d rather not have an easily accessible method for accidentally executing code sent from a worker on the scheduler.

I know that this functionality was introduced mainly for debugging purposes in https://github.com/dask/distributed/pull/808, so was hoping we could introduce a config setting that turned this feature off (probably by just implementing a simple if / else in https://github.com/dask/distributed/blob/master/distributed/scheduler.py#L3069).

I’m happy to make the PR but wanted to open this issue for discussion before doing so.

[mrocklin]

And then layering a config setting on top that automatically adds [‘terminate’, ‘feed’, ‘run_function’] to the blocked_handlers for the Scheduler.

Before we bake in a config setting I’m inclined to see if we might just have the blocked handlers as the config, and then have docs that encourage people to use a particular set in the scheduler. I’m trying to avoid having many small special cased options and instead have a few relatively general purpose ones until we see very common patterns emerge.

[mrocklin]

Interesting; so that could be as simple as providing a list of strings to the blocked_handlers kwarg, and then pop those keys from self.handlers in the Server init, correct?

Could pop, or could check the blocked_handlers on each message and raise an informative error.

if op in self.blocked_handlers:
    raise Exception("The op OP has been explicitly disallowed in this TYPENAME, possibly due to security concerns")
else:
    func = self.handlers[op]
    ...