WEBKIT_FORCE_SANDBOX no longer allows disabling the sandbox. Use WEBKIT_DISABLE_SANDBOX_THIS_IS_DANGEROUS=1 instead

[bubbleguuum]

Starting nyxt git compiled for openSUSE Tumbleweed with WebKitGTK 2.40.0 results in a crash

Nyxt version 3
<INFO> [16:50:35] Source location: #P"/usr/share/"
<INFO> [16:50:35] Listening to socket: #P"/run/user/1000/nyxt/nyxt.socket"

** (nyxt:1191): WARNING **: 16:50:35.289: WEBKIT_FORCE_SANDBOX no longer allows disabling the sandbox. Use WEBKIT_DISABLE_SANDBOX_THIS_IS_DANGEROUS=1 instead.
<INFO> [16:50:35] GTK extensions directory: #P"/usr/share/libraries/web-extensions/"
<INFO> [16:50:35] GTK extensions directory: #P"/usr/share/libraries/web-extensions/"

** (nyxt:1191): ERROR **: 16:50:35.629: Unable to configure xdg-desktop-portal access in the WebKit sandbox: GApplication is required.
<WARN> [16:50:35] Warning: Error in FFI method: The value
  :INVALID-CODE-OBJECT-AT-PC
is not of type
  (SIMPLE-ARRAY (COMPLEX DOUBLE-FLOAT) (*))

** (process:1191): ERROR (recursed) **: Unable to configure xdg-desktop-portal access in the WebKit sandbox: GApplication is required.
fatal error encountered in SBCL pid 1191 tid 1212:
SIGABRT received.

Starting it with WEBKIT_DISABLE_SANDBOX_THIS_IS_DANGEROUS=1 fixes it:

WEBKIT_DISABLE_SANDBOX_THIS_IS_DANGEROUS=1 nyxt

So i suppose code should be updated to use WEBKIT_DISABLE_SANDBOX_THIS_IS_DANGEROUS for newer WebKitGTK versions.

[Ambrevar]

@aartaka We still haven't fixed this sandboxing issue #1781. I'd argue that it's 3.0 critical. Tag?

Is it realistic to fix it? If not, then we should drop WebExtension support in the official build of Nyxt to not force users to disable sandboxing.

EDIT: See also #2177; WebExtension support is currently broken.

[aartaka]

@aartaka We still haven't fixed this sandboxing issue #1781. I'd argue that it's 3.0 critical. Tag?

Yeah :(

Is it realistic to fix it? If not, then we should drop WebExtension support in the official build of Nyxt to not force users to disable sandboxing.

It is realistic to fix it, if we move extensions directory to /usr/local/lib/nyxt/. This way it's beyond XDG dirs, consistent with other browsers, and makes sure one installs the shared library extensions only when they know what they're doing.

But yes, I'd drop WebExtensions support library anyway, because it's painful to do it in C, and we can replace all of it with a properly linkable Lisp library.

[Ambrevar]

This way it's beyond XDG dirs, consistent with other browsers, and makes sure one installs the shared library extensions only when they know what they're doing.

That wouldn't work on Nix / Guix, right?

But yes, I'd drop WebExtensions support library anyway, because it's painful to do it in C, and we can replace all of it with a properly linkable Lisp library.

Wanna send a PR to remove the build by default and re-enable sandboxing?

We need a knob so disable sandboxing when the experimental WebExtension support is built into the binary.
Or... Maybe just check if the lib.so can be loaded, and if it is, then disable sandboxing?

[aartaka]

This way it's beyond XDG dirs, consistent with other browsers, and makes sure one installs the shared library extensions only when they know what they're doing.

That wouldn't work on Nix / Guix, right?

Hmmmmmmmmmm, yes. I guess we'll have to implement GApplication after all. I'm still clueless about how to do it in a way that doesn't restrict us in a major way.

But yes, I'd drop WebExtensions support library anyway, because it's painful to do it in C, and we can replace all of it with a properly linkable Lisp library.

Wanna send a PR to remove the build by default and re-enable sandboxing?

Yes, will do!

We need a knob so disable sandboxing when the experimental WebExtension support is built into the binary. Or... Maybe just check if the lib.so can be loaded, and if it is, then disable sandboxing?

That's hard, because WebKit manages things independently and gives us no control of extensions. But yes, we can check the directory for any .so file and disable sandboxing then.

Note that if we implement GApplication, we will not need to disable sandboxing.

[KarlJoad]

I just tested a build of Pre-Release 6 on Guix System today, so I could start building my configuration before the release of Nyxt 3. I am still having this same problem.

I am attaching the relevant Guix channel information and the package definition I made to get Nyxt 3-rc6 building.

(list (channel
        (name 'guix)
        (url "https://git.savannah.gnu.org/git/guix.git")
        (branch "master")
        (commit
          "61d15695752997427ed9c3491470dd76b11bd00a")
        (introduction
          (make-channel-introduction
            "9edb3f66fd807b096b48283debdcddccfea34bad"
            (openpgp-fingerprint
              "BBB0 2DDF 2CEA F6A8 0D1D  E643 A2A0 6DF2 A33A 54FA")))))

(use-modules (guix packages)
             (guix git-download)
             (gnu packages web-browsers)
             (gnu packages lisp-xyz))

(define-public nyxt-next
  (package
   (inherit nyxt)
   (version "3-pre-release-6")
   (source
    (origin
     (method git-fetch)
     (uri (git-reference
           (url "https://github.com/atlas-engineer/nyxt")
           (commit version)))
     (sha256
      (base32
       "174j7qvjkmvq0iikskgrn5bh1nkhxqjnmp948wp9abbcmpn87rrf"))
     (file-name (git-file-name "nyxt" version))))
   (inputs
    (append `(("cl-gopher" ,sbcl-cl-gopher)
              ("cl-tld" ,sbcl-cl-tld)
              ("dissect" ,sbcl-dissect)
              ("history-tree" ,sbcl-history-tree)
              ("lass" ,sbcl-lass)
              ("montezuma" ,sbcl-montezuma)
              ("nclasses" ,sbcl-nclasses)
              ("ndebug" ,sbcl-ndebug)
              ("nfiles" ,sbcl-nfiles)
              ("njson" ,sbcl-njson)
              ("nhooks" ,sbcl-nhooks)
              ("nkeymaps" ,sbcl-nkeymaps)
              ("nsymbols" ,sbcl-nsymbols)
              ("ospm" ,sbcl-ospm)
              ("py-configparser" ,sbcl-py-configparser)
              ("phos" ,sbcl-phos)
              ("slynk" ,sbcl-slynk))
            (package-inputs nyxt)))))

nyxt-next

After building, I still need to do export WEBKIT_DISABLE_SANDBOX_THIS_IS_DANGEROUS=1; /gnu/store/...-nyxt-3-pre-release-6/bin/nyxt to be able to run Nyxt at all.

[aadcg]

I think we need to convince Guix to upgrade webkitgtk to 2.40.1.

In light of this information, it may solve the problem for us with no work at all.

[KarlJoad]

I prepared a patch for Guix updating webkitgtk from 2.40.0 to 2.40.1, which you can see/track here: https://debbugs.gnu.org/cgi/bugreport.cgi?bug=62987
I just tested a rebuild with the Nyxt package definition above, and it ran fine without the need for WEBKIT_DISABLE_SANDBOX_THIS_IS_DANGEROUS=1. (I was able to browse GitHub from within Nyxt without anything special.)

Though YouTube continues to not work with this package definition (which is probably because of missing GStreamer plugins).

[aadcg]

@KarlJoad Great, thank you!

The GitHub issue is present in webkitgtk version 2.38.5.

[aadcg]

For those who have this issue: bump webkitgtk version to 2.40.1, so that disabling sandbox is not required.

Thanks again @KarlJoad.