[Bug]: The SUID sandbox helper binary was found, but is not configured correctly. Rather than run without sandboxing I'm aborting now.

[Nantris]

Preflight Checklist

• I have read the Contributing Guidelines for this project.
• I agree to follow the Code of Conduct that this project adheres to.
• I have searched the issue tracker for a bug report that matches the one I want to file, without success.

Electron Version

30.1.0

What operating system are you using?

Ubuntu

Operating System Version

Kubuntu 24.04

What arch are you using?

x64

Last Known Working Electron version

Unknown

Expected Behavior

Upgrading Kubuntu from 23.10 to 24.04 should not cause this error even after clearing node_modules and running yarn cache clean.

I also manually ensured there were no cached versions of Electron.

Actual Behavior

This error persists and I cannot run our project.

Testcase Gist URL

No response

Additional Information

Only began after upgrading Kubuntu to 24.04.

[Nantris]

This is the full error message:

[1] [13329:0614/163124.425381:FATAL:setuid_sandbox_host.cc(158)] The SUID sandbox helper binary was found, but is not configured correctly. Rather than run without sandboxing I'm aborting now. You need to make sure that /home/me/Documents/projects/OurProject/node_modules/electron/dist/chrome-sandbox is owned by root and has mode 4755.

Needing to run that every time we reinstall our dependencies is very tedious, and in a case where someone is not allowed root access then this becomes impossible to work around?

[frfernandezdev]

x2

[frfernandezdev]

x2

I found why it is failing, and I also found the solution.

2.3.2 AppImage fails to start due to missing sandboxing #2429

As mentioned in the reference documentation, the problem is that Ubuntu 24.04 implemented new restrictions for AppImage apps, which restricts the use of sandboxes.

The solution is to lift the restrictions that Ubuntu 24.04 implements in the AppImages.

sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0

for deactivate restrictions

sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=1

for activate restrictions

I hope it serves as a temporary solution.

[Nantris]

Thanks for investigating and sharing! But it's affecting even development where the app isn't packaged. Is that still relevant?

[Nantris]

@codebytere is this something that can be resolved or will we need to revert to using 23.10 indefinitely to avoid this? Every yarn install brings this issue back and it's really making development a pain.

[Nantris]

This occurs in Electron Fiddle as well. Resolving it then leads to: FATAL:zygote_host_impl_linux.cc(201)] Check failed: . : Invalid argument (22)

I may have mistyped that, since unfortunately Electron Fiddle's console does not allow copying.

[frfernandezdev]

Thanks for investigating and sharing! But it's affecting even development where the app isn't packaged. Is that still relevant?

In my case the error happens when I go to run 'npm start' and it gives me the error when compiling the app in the development environment. By implementing the solution I mentioned above I was able to temporarily solve the problem. Although I haven't tested when compiling in production.

[Nantris]

A more targeted and safe, although more tedious, temporary solution is: sudo chown root ./node_modules/electron/dist/chrome-sandbox && sudo chmod 4755 ./node_modules/electron/dist/chrome-sandbox

But you'll have to reapply it any time the node_modules is rewritten, so it's really very tedious. It can also cause permission errors because it can cause folders you create to end up owned by root, and then inaccessible to normal users.

[frfernandezdev]

A more targeted and safe, although more tedious, temporary solution is: sudo chown root ./node_modules/electron/dist/chrome-sandbox && sudo chmod 4755 ./node_modules/electron/dist/chrome-sandbox

But you'll have to reapply it any time the node_modules is rewritten, so it's really very tedious. It can also cause permission errors because it can cause folders you create to end up owned by root, and then inaccessible to normal users.

In my case, this solution was not successful.

[mlaurencin]

@Nantris I am just looking to confirm the steps needed to reproduce this issue. Are you saying that running the default test in Electron Fiddle results in that first full error message, and then the second fatal message when you attempt the first workaround?

If not, could you specify what steps you are doing to recreate your issue with Electron Fiddle? I'm marking this issue with blocked/need-info.

[Nantris]

Thanks for looking into this @mlaurencin!

Indeed the original message affects both Electron and Electron Fiddle.

Using this workaround (but with the path in the Electron Fiddle error instead of node_modules) leads to the second error:

FATAL:zygote_host_impl_linux.cc(201)] Check failed: . : Invalid argument (22)