M117+ removes the 'sudo' command.

[DennisLfromGA]

Chrome version M117+ removes the sudo command which brings up some questions for the continued use of crouton.

When entering a crosh shell session we now get the following message:

Sudo commands will not succeed by default.
If you want to use sudo commands, use the VT-2 shell
(Ctrl-Alt-{F2/Right arrow/Refresh}) or build the image with the
login_enable_crosh_sudo USE flag:

$ USE=login_enable_crosh_sudo emerge-$BOARD chromeos-login
or
$ USE=login_enable_crosh_sudo cros build-packages --board=$BOARD

Although not yet possible with Chrome beta version 117.0.5938.22, the above alludes to the possibility of still being able to run the sudo command in the VT-2 shell, let's hope that comes to fruition.

So, for the time being, short of rebuilding the board image with the flag(s) mentioned above, we can no longer run crouton as user 'chronos' in a crosh shell or the VT-2 shell, when attempting to do so the following message is displayed when invoking the sudo command:

sudo: The "no new privileges" flag is set, which prevents sudo from running as root.
sudo: If sudo is running in a container, you may need to adjust the container configuration to disable the flag.

I guess some of the foremost questions are:

1. Can we / Should we run crouton as root or even chronos in the VT-2 shell?
2. If we run crouton in the VT-2 shell will the GUI desktops still launch & work?
3. Is crouton still a viable way to run Linux distros in a chroot or should we move to Crostini and stop using crouton?

I think once Chrome version M117 lands in the stable channel, currently scheduled for Tue, Sep 19, 2023, we'll all be facing these issues.

-DennisLfromGA

[dnschneid]

Yeah, that's really unfortunate. Hopefully they actually enable sudo in VT-2. I can't find any public bugs on it, so if you file or discover one, please share a link.

1. You will be able to enter a crouton shell from VT-2, but native graphical sessions will be difficult, as you suspected.
2. The difficulty with VT2 is due to the way Chromium and frecon hand off control of the display -- we can ask Chromium to release the display but there's no equivalent interface for it in frecon. There was discussion a long time ago to add that, but as far as I can tell that never materialized. Launching a xiwi graphical session might just work. Launching a native graphical session will likely work if you run sshd in your chroot from VT2 and then SSH from Chromium OS to launch your desktop environment. You could even make a profile in Secure Shell that just runs the start[whatever] command.
3. I recommend using crostini if it can do what you need it to do. The feature disparity is always shrinking, and crouton is slowly(?) bitrotting due to Chromium OS's constant development.

[DennisLfromGA]

@dnschneid

Hopefully they actually enable sudo in VT-2. I can't find any public bugs on it, so if you file or discover one, please share a link.

Nothing public yet, the only thing I saw was this statement added to the crosh shell invocation:

"If you want to use sudo commands, use the VT-2 shell"

Also, mr.chromebox evidently made some progress with it, he mentioned this on his Discord server:

"I got Google to fix it but who knows how long it will take to propagate."

-DennisLfromGA

[darrell-k]

@dnschneid

2. Launching a native graphical session will likely work if you run sshd in your chroot from VT2 and then SSH from Chromium OS to launch your desktop environment.

This works. After installing openssh-server I needed to create directory /run/sshd.

For anyone looking for a guide to get back their GUI Crouton:

1. <Ctrl><alt><refresh> to open VT2 (a full screen terminal)
2. log in as chronos (no password unless you've previously created one)
3. sudo apt install openssh-server
4. sudo mkdir /run/sshd
5. sudo /usr/sbin/sshd
6. <Ctrl><alt><back arrow> to return to Chrome gui
7. in the crosh shell: ssh <user>@localhost where <user> is your Crouton user and then at the new prompt, startxfce or startgnome or whatever.

Edit: originally I had step 7 as "in the crosh shell: ssh localhost ..." which was wrong: you need to specify the user you created for Crouton, otherwise ssh will try to connect as the current user, chronos, which does not exist in your chroot.

I really don't know what Google was thinking of with this change: anyone who has gone to the trouble of enabling developer mode and installing crouton (or anything else that requires root) obviously wanted to do it. I think they've always said they won't support developer mode problems, so why not leave it at that?

Looks like someone at Google decided to solve a problem that didn't exist, and in doing so stripped functionality from people (like me) who would never have bought a Chromebook if it wasn't for Crouton. It's all very well saying use Crostini, which I do for some things, but it's slow on low spec machines and it's quite possible to hard-lock the machine if you try to do too much.

Rant over.

[darrell-k]

At least on my machine (Asus C433, running M117) Ctrl-Alt-right arrow(F2), Ctrl-Alt-refresh(F3) and Ctrl-Alt-full screen(F4) all launch VTs.

[dnschneid]

I haven't spoken with anyone at Google about this latest change so I can't say for sure the exact motivation. But the fact is, the shell exists in verified mode, even if you're not supposed to be able to access it. Getting to the shell is usually one stage in exploit chains, following by privilege escalation. The limitations on where scripts can run from was an attempt to fortify against shell access in verified mode. Locking down sudo is an attempt to fortify against privilege escalation. Both enhance Chromium OS's defense-in-depth.

While developer mode exists and will continue to exist, they can't have too many differing behaviors between it and verified mode. Sometimes that's because it's a compile-time kernel flag that sets the policy, so they realistically can't make the behavior different. Othertimes it's to minimize the possibility of bugs and holes (it would really suck if developer-mode-only features got somehow enabled in verified mode as part of an exploit chain).

The logic is that you should be able to get basic stuff done in dev mode even if you have to jump through hoops. crouton tries to carve a convenient path through said hoops, but it doesn't get special treatment. If you really want to go to town on your system as a Linux-first machine, you can always install a test image (which distances you from verified mode a bit farther but it's still Chromium OS), or use one of the many dual-boot approaches -- both avenues the Chromium OS team ensures remain possible.

[CroutonIsFun]

Ahhh, yeah, my mistake, I was thinking Esc-Refresh-Power.

I have the same 3 VT's as you do. Ha! I learned something new today!

[darrell-k]

There's a mistake in my instructions above:

ssh localhost should be ssh <user>@localhost (where is the user you created for Crouton). Sorry if this wasted anyone's time.

@CroutonIsFun has written an excellent wiki page which deals with this issue here: https://github.com/dnschneid/crouton/wiki/Crouton-Quick-Start

[Fazzuliyat]

Anyway to scroll up on VT2 (a full screen terminal) ?

[CodeThePeace]

@dnschneid thoughtfully wrote:

I really don't know what Google was thinking of with this change: anyone who has gone to the trouble of enabling developer mode and installing crouton (or anything else that requires root) obviously wanted to do it. I think they've always said they won't support developer mode problems, so why not leave it at that?

Looks like someone at Google decided to solve a problem that didn't exist, and in doing so stripped functionality from people (like me) who would never have bought a Chromebook if it wasn't for Crouton. It's all very well saying use Crostini, which I do for some things, but it's slow on low spec machines and it's quite possible to hard-lock the machine if you try to do too much.

My reply begins:
I'm reluctant to comment, particularly as I haven't solved the issue yet. I basically agree with dnschneid, but I have a slightly different take on the issue even though my situation is somewhat typical of people who have been posting on the forums about the sudo command not succeeding by default.

The chromebook updated automatically, and with the next restart, sudo wasn't working. I use bash in a chroot container. Occasionally, I use the Ubuntu desktop, because it gives me simple access to X11 apps. I am able to switch to a VT-2 shell, and switching to root does work in the developer console. I am able to get some functionality from the chroot container, but I can't access the Ubuntu desktop or the X11 apps. I've only been working on this problem for a week, and I am surprised to read that people have been trying to solve this for over a month.

Where my view differs slightly from dnschneider is that, it is not only the people that are using crouton who are affected by the "deprecation" of sudo, but anyone using any terminal emulator on the chromebook, will discover that bash is essentially not functional.

I can't understand the logic, because it seems to me that Sudo itself is a security measure that has probably been around for 75 years. As my AI constantly reminds me, it is dangerous to let other processes run as root and use sudo. And you would have to agree, you can't just let anyone use sudo. So, maybe the thinking was that eliminating sudo was just the security measure that was needed for the update. Well, it was nice that we got a message of the day telling us that the sudo privileges need to be set with two cumbersome options on building the image.

[CroutonIsFun]

There is nothing wrong with crouton. MrChromebox says crouton is "deprecated" (see here) but he doesn't get to decide what I run on my own Chromebook. As long as you can use sudo in VT-2, then the "problem" is solvable.

There is nothing illegitimate about using crouton. It still does what it was intended to do, and I appreciate the thought which went into to creating this amazing script.

I wonder if we should refer to 3 virtual terminals:

Ctrl-Alt-F2 = VT-2
Ctrl-Alt-F3 = VT-3
Ctrl-Alt-F4 = VT-4

[Spiderkid2013]

i just realized that there are 2 VTs

[Apocalypse10110]

Can someone help me install Crouton in 2024. I have read through dozens of articles but that has made me even more confused.

[YeesterPlus]

just use chromebrew and run crew install crew-sudo; bash ~/.bashrc in VT2-4