-
Notifications
You must be signed in to change notification settings - Fork 556
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Electron & Chromium #2946
Comments
Hi, I again have a problem with slack after upgrading it to 4.1.1 on Debian 9. I tried to add to it the parameters indicated above, without change. update not sure about the following, it may be because i use fish as a shell I tried also the command |
Hi, Visual Studio Code won't start up at all under Archlinux.
This is the output at startup:
Tried both commands recommended at the top. |
@daks @StarPicard Can you guys open own issues for that. This issue is to catch the chromium sandbox on program update (I update the OP). @StarPicard can you also post your globals.local. |
@rusty-snake done |
All AppImages with chromium/electron programs are broken because |
Hi, wire-desktop (electron6) got the problem. |
Hi @rusty-snake it works like this with electron6 bin too in my case (under archlinux) |
Slack is broken, fixed when adding |
* discord 0.10 | fix #3247 * revert private-bin move & use disable-exec * fix slack, see #2946 (comment)
I've added the fixes but slack (4.4.0) is still not working. It got rid of the errors but get stuck in the
|
How do you installed slack? snap isn't supported by firejail. |
I'd like to tighten this up more esp. for seccomp - caps.keep sys_chroot needed or fails with Cannot chroot into /proc/ directory: Operation not permitted 1. caps.drop all replaced with caps.keep - caps.keep sys_admin needed or fails with Failed to move to new namespace: PID namespaces supported, Network namespace supported, but failed: errno = Operation not permitted 2. nonewprivs dropped to avoid failure: The setuid sandbox is not running as root. Common causes: * An unprivileged process using ptrace on it, like a debugger. * A parent process set prctl(PR_SET_NO_NEW_PRIVS, ...) Failed to move to new namespace: PID namespaces supported, Network namespace supported, but failed: errno = Operation not permitted 3. noroot dropped to avoid failure: [22:0404/121643.400578:FATAL:setuid_sandbox_host.cc(157)] The SUID sandbox helper binary was found, but is not configured correctly. Rather than run without sandboxing I'm aborting now. You need to make sure that /usr/lib/slack/chrome-sandbox is owned by root and has mode 4755. 4. Removed protocol filter to avoid: The setuid sandbox is not running as root. Common causes: * An unprivileged process using ptrace on it, like a debugger. * A parent process set prctl(PR_SET_NO_NEW_PRIVS, ...) Failed to move to new namespace: PID namespaces supported, Network namespace supported, but failed: errno = Operation not permitted 5. Unable to get a working seccomp filter See #2946 (comment) seccomp !chroot seems to have worked for earlier versions of slack 6. private-tmp means no tray icon Observed on Debian 10, Slack 4.4.0
I've installed it from the .deb file, not the snap store :( |
Can you post your current profile. |
I don't know what the issue is with slack but this profile seems to work for me on Arch using the AUR slack-desktop package, the sign-in won't work because that is a redirect to firefox, so one time setup without firejail and subsequent sessions can be firejailed https://imgur.com/pWZjW6x This is more hardened than in master. |
There are serveral issues with the chromium sandbox (see below) which is also used in electron. If firejail breaks a electron-based program (or any other program internaly using chromium) and the problem can be fixed by adding
seccomp !chroot
to PROFILE.local, post here which program is affected. Note: If you are not using firejail lastet git, you must add the following to PROFILE.local to get the same effect:If this doesn't work, but
firejail --ignore=nonewprivs --ignore=noroot --ignore=protocol --ignore=seccomp --ignore=caps.drop --caps.keep=sys_admin,sys_chroot PROGRAM
works, say it here. Otherwise open a new issue.If none of the commands works, open a new issue.
Some issues about the chromium-sandbox:
#2933 - skypeforlinux 8.51.0.86 now requires SYS_ADMIN, SYS_CHROOT capabilities
#2912 - Skypeforlinux 8.51.0.72 crashes on startup since it's not permitted to use the chroot syscall
#2945 - Signal 1.27 Fails to Start
#2866 - new version of Slack Desktop (4.0) not working
#2854 - Standard notes not working
#2901 - [Teamspeak 3] crashes on opening options window if seccomp is enabled
#2821 - /usr/bin/riot-desktop: line 3: 8 Trace/breakpoint trap (core dumped) electron /usr/lib/riot/ "$@"
#2943 - firejail - Ubuntu 19.10 snap chromium incompatibility
#2944 - Firejail breaks Brave browser default sandboxing
Three new issues in 10 hours 😱 .
![](https://gist.githubusercontent.com/rusty-snake/9741684540c099c0677f41facf100da4/raw/2b853a00aca20f8a524af078c52c720745d820ca/screenshot.png)
The text was updated successfully, but these errors were encountered: