[fixed in beta] steamwebhelper crashes on Debian 10, RHEL 7, SteamOS 2: No usable sandbox

[smcv]

Your system information

• Steam client version (build number or date): beta 1644966673, 2022-02-15
  • Issue confirmed to still be present in beta 1645226026, 2022-02-18
  • Issue confirmed to still be present in general-availability release 1646446125, 2022-03-05
  • Issue is fixed in beta 1646806235, 2022-03-09
• Distribution (e.g. Ubuntu): Debian 10 and SteamOS 2 tested; problem likely also occurs on RHEL/CentOS 7
• Opted into Steam client beta?: yes
• Have you checked for system updates?: yes

Steps for reproducing this issue:

1. Have an operating system where creation of new user namespaces is restricted:
   • Debian 10 or older (I tested Debian 10)
   • SteamOS 2 (also tested)
   • RHEL 7 or its derivatives
   • Arch Linux with the non-default linux-hardened kernel
   • anything else where Flatpak would require a setuid bwrap executable
2. Opt-in to the beta branch of Steam
3. Run Steam

Please describe your issue in as much detail as possible:

The steamwebhelper process that provides most of Steam's UI crashes repeatedly, resulting in Steam's main window (the Library, Store, etc.) being blank rectangles (usually black).

The main Steam process repeatedly logs:

steamwebhelper.sh[...]: Runtime for steamwebhelper: defaulting to .../ubuntu12_64/steam-runtime-heavy
src/steamexe/main.cpp (253) : Assertion Failed: reaping pid: ... -- steam

and also

src/common/html/chrome_ipc_client.cpp (410) : m_hCEFHandle == INVALID_PROCESS_HANDLE

~/.steam/root/logs/steamwebhelper.log contains:

...:FATAL:zygote_host_impl_linux.cc(116)] No usable sandbox! Update your kernel or see https://chromium.googlesource.com/chromium/src/+/master/docs/linux/suid_sandbox_development.md for more information on developing with the SUID sandbox. If you want to live dangerously and need an immediate workaround, you can try using --no-sandbox.

as well as some noise related to Steam's crash-reporting mechanism.

~/.steam/root/logs/cef_log.txt has the same message as in ~/.steam/root/logs/steamwebhelper.log.

This was previously reported in #8373 as the second of three possible root causes for symptoms like these.

Workarounds

Choose any one of these:

• Run Steam with the -no-cef-sandbox command-line option (typically steam -no-cef-sandbox)
• Configure your OS to allow unprivileged creation of user namespaces
• If you are using Debian 10, upgrade to Debian 11
• If you are using RHEL 7, upgrade to RHEL 8
• If you are using Arch Linux linux-hardened, switch to the default linux kernel
• Run the Steam general-availability branch instead of the beta until this is resolved
  • You can still use Steam → Settings to opt out from the beta, even though most of the UI is crashing
• Set the Steam user interface to Compact mode
• Set the Steam user interface to Big Picture mode

Solution

Steam should do the equivalent of -no-cef-sandbox on these mostly older operating systems. This is not ideal, but is the best it can do. I have already provided Valve developers with a proposed change in steamwebhelper.sh, which I believe is making its way through the release process.

This is not necessarily the same bug you are seeing

Any bug that results in the steamwebhelper crashing will result in the same symptom where the main window is mostly black. This does not mean that the root cause is the same as the one described here.

If the -no-cef-sandbox workaround does not work for you, then you are seeing a different issue and should report it separately.

If Flatpak works on your system, and you do not have a setuid bubblewrap executable (typically /usr/bin/bwrap or /usr/libexec/flatpak-bwrap), then you are seeing a different issue and should report it separately.

If you are running the unofficial Flatpak version of Steam from Flathub, then you are seeing a different issue, #8421.

[TTimo]

Fixed in latest Steam beta.

[smcv]

General-availability release 1646446125, 2022-03-05, still has this bug. See the issue description for workarounds.

Beta 1646806235, 2022-03-09, fixes this bug.

[TTimo]

Hotfix shipped to stable yesterday that should fix this too.

[smcv]

Yes, confirmed fixed: I swapped my Debian 10 machine from beta back to GA, and was given the same build 1646806235 that was previously in the beta.