Re: Electron apps in Debian with --no-sandbox

From	Sven Hartge <sven@svenhartge.de>
Newsgroups	linux.debian.user
Subject	Re: Electron apps in Debian with --no-sandbox
Date	2020-12-07 08:10 +0100
Message-ID	<BjiOK-4MI-9@gated-at.bofh.it> (permalink)
References	<Bji2l-4ht-5@gated-at.bofh.it>
Organization	Newsfeed am Wurmloch

Show all headers | View raw

buckwheatpancake <buckwheatpancake@protonmail.com> wrote:

> So, Electron stuff in Debian comes with this annoying thing where it tells you chrome-sandbox (in various applications) needs to be owned by root and have mode 4755. If you set that, it just tells you the same, with another file. I've taken to running these things with the --no-sandbox option, because I don't know what the solution is... is this safe or recommended?

You are hitting https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=898446
and the fact that the Debian Kernel is patched to disable creation of
user namespaces from non-privileged process.

The canonically correct solution here is to do the following, as root:


echo 'kernel.unprivileged_userns_clone=1' > /etc/sysctl.d/00-local-userns.conf
service procps restart

That should resolve this problem for now, until Debian concludes their
discussion in the linked bug and enables this feature per default, as
most other distributions already do.

Grüße,
Sven.

-- 
Sigmentation fault. Core dumped.

Back to linux.debian.user | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

Electron apps in Debian with --no-sandbox buckwheatpancake <buckwheatpancake@protonmail.com> - 2020-12-07 07:20 +0100
  Re: Electron apps in Debian with --no-sandbox Sven Hartge <sven@svenhartge.de> - 2020-12-07 08:10 +0100

csiph-web