Beaker: Appimage needs `--no-sandbox` set during build in order to start (Solved)

Created on 17 Mar 2020 · 12Comments · Source: beakerbrowser/beaker

Running MX Linux here. The appimage 0.8.9 and 0.8.10 both wont launch. Only the appimage 0.8.8 is working. Issue might be related with MX Linux using systemd-shim? https://mxlinux.org/blog/about-mx-19-and-systemd/
Appimage v0.8.10 does work on LinuxLite which have full systemd
OS: MX x86_64
Kernel: 4.19.0-6-amd64

DE: Xfce

OS: Linux Lite 4.8 x86_64
Kernel: 4.15.0-88-generic
DE: Xfce

New edit(Solved): Found this command line: sudo sysctl kernel.unprivileged_userns_clone=1
Run the command line in terminal and after run the appimage. That fixed my issue here

bug linux

Source

danrobi11

All 12 comments

On elementary OS 5.1.2 hera (x86_64 Linux 5.3.0-42-generic), I can run 0.8.10 just fine. Could this be distro-specific, or perhaps something unique to your PC's installation?
My full screenfetch output is down below:

                                     emil@emil-G11CD
         eeeeeeeeeeeeeeeee           OS: elementary OS 5.1.2 hera
      eeeeeeeeeeeeeeeeeeeeeee        Kernel: x86_64 Linux 5.3.0-42-generic
    eeeee  eeeeeeeeeeee   eeeee      Uptime: 6h 30m
  eeee   eeeee       eee     eeee    Packages: 2416
 eeee   eeee          eee     eeee   Shell: bash 4.4.20
eee    eee            eee       eee  Resolution: 1920x1080
eee   eee            eee        eee  DE: GNOME 
ee    eee           eeee       eeee  WM: Mutter(Gala)
ee    eee         eeeee      eeeeee  WM Theme: elementary
ee    eee       eeeee      eeeee ee  GTK Theme: elementary [GTK2/3]
eee   eeee   eeeeee      eeeee  eee  Icon Theme: elementary
eee    eeeeeeeeee     eeeeee    eee  Font: Open Sans 9
 eeeeeeeeeeeeeeeeeeeeeeee    eeeee   CPU: Intel Core i7-6700 @ 4x 4GHz [35.0°C]
  eeeeeeee eeeeeeeeeeee      eeee    GPU: GeForce GTX 970
    eeeee                 eeeee      RAM: 4529MiB / 7887MiB
      eeeeeee         eeeeeee       
         eeeeeeeeeeeeeeeee

limeschool on 23 Mar 2020

Are you able to launch from the terminal and check for error output?

pfrazee on 23 Mar 2020

$ ./Beaker.Browser-0.8.10.AppImage
[31586:0323/140435.815051:FATAL:setuid_sandbox_host.cc(157)] The SUID sandbox helper binary was found, but is not configured correctly. Rather than run without sandboxing I'm aborting now. You need to make sure that /tmp/.mount_Beakerk7tnAQ/chrome-sandbox is owned by root and has mode 4755.
Trace/breakpoint trap

danrobi11 on 23 Mar 2020

$ ./Beaker.Browser.0.8.9.AppImage
zenity, kdialog, Xdialog missing. Skipping /tmp/.mount_BeakerZz8HtL/AppRun.
[32103:0323/141017.263598:FATAL:setuid_sandbox_host.cc(157)] The SUID sandbox helper binary was found, but is not configured correctly. Rather than run without sandboxing I'm aborting now. You need to make sure that /tmp/.mount_BeakerZz8HtL/chrome-sandbox is owned by root and has mode 4755.
Trace/breakpoint trap

danrobi11 on 23 Mar 2020

Oof, this is a bummer. Related issues:

Looks like neither snap or appimage can run with process sandboxing enabled. Based on https://github.com/electron-userland/electron-builder/blame/fc311995c196f1063ceb2d0bb0af61beac6038e8/packages/app-builder-lib/src/targets/snap.ts#L188 it looks like they disable the sandbox automatically for snaps but not appimage. Can anybody confirm if the beaker 0.8.10 snap works correctly?

We'll have to update the build for the appimage manually.

EDIT: just to comment on the security, basically the process-sandbox is a second layer of defense. There's a "Web Platform" sandbox by default which doesn't expose any access to the OS. The process-sandbox further isolates the browser's processes so that an exploit in the Web Platform has a harder time attacking the OS. Disabling the process-sandbox is not preferable but it does not remove the Web Platform sandbox; it removes a secondary defense.

pfrazee on 25 Mar 2020

I just tested the snap v0.8.10 works perfectly and does sync with hashbase without having to restart beaker.

danrobi11 on 25 Mar 2020

Okay interesting. It may be time to deprecate the appimage

pfrazee on 25 Mar 2020

I might have a similar issue with Beaker.Browser-1.0.0-prerelease.1.AppImage on Debian.

[4554:0515/103927.209754:FATAL:setuid_sandbox_host.cc(157)] The SUID sandbox helper binary was found, but is not configured correctly. Rather than run without sandboxing I'm aborting now. You need to make sure that /tmp/.mount_BeakerDUCapz/chrome-sandbox is owned by root and has mode 4755.
fish: “./Beaker.Browser-0.8.10.AppImage” terminated by signal SIGTRAP (Trace or breakpoint trap)

raphaelbastide on 15 May 2020

👍1

@raphaelbastide See my new edit(Solved) in the description. Should also work for you

danrobi11 on 15 May 2020

@raphaelbastide See my new edit(Solved) in the description. Should also work for you

Works perfectly, thank you @danrobi11. Do you know what this command does?

raphaelbastide on 15 May 2020

@raphaelbastide noclue. found it on the internet. nice workaround until this get fixed.
This issue is not related to beaker only, this happens to me with most appimages

danrobi11 on 15 May 2020

👍1

@raphaelbastide noclue. found it on the internet. nice workaround until this get fixed.
This issue is not related to beaker only, this happens to me with most appimages

This is a little bit "apples and oranges", but I've had to use that when I couldn't get a browser to open as root. It would be during times I had to login as root, not just via sudo or su -. It was the only way I could access the Internet to find out how to fix whatever I'd broken with my normal user. :laughing:

My memory's foggy about it now, but it seems like that flag and whichever browser I was using had something to do with how the affected browser accessed whatever it needed to function. That functionality is blocked for a few programs with the possible thought process that root is supposed to get in, do some admin work, and then get out, not hang out playing around with games and the Internet, etc.

Because I'm always curious, too, I just tried a "what does the --no-sandbox flag do" search and received these two from the front page: