Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Dockerized chrome sandbox problem #17

Closed
brunetto opened this Issue Apr 26, 2015 · 7 comments

Comments

Projects
None yet
3 participants
@brunetto
Copy link

brunetto commented Apr 26, 2015

It seems chrome is not able to run with sandbox. It suggests to recompile with that option.

[1:1:0426/110158:ERROR:browser_main_loop.cc(171)] Running without the SUID sandbox! See https://code.google.com/p/chromium/wiki/LinuxSUIDSandboxDevelopment for more information on developing with the sandbox on.

May be is there another workaround?

@jessfraz

This comment has been minimized.

Copy link
Owner

jessfraz commented Apr 26, 2015

It's just a warning it works regardless they are even depreciatinng the suid sandbox in favor of the one w userns

On Sunday, April 26, 2015, brunetto notifications@github.com wrote:

It seems chrome is not able to run with sandbox. It suggests to recompile
with that option.

[1:1:0426/110158:ERROR:browser_main_loop.cc(171)] Running without the SUID sandbox! See https://code.google.com/p/chromium/wiki/LinuxSUIDSandboxDevelopment for more information on developing with the sandbox on.

May be is there another workaround?


Reply to this email directly or view it on GitHub
#17.

Jessie Frazelle
4096R / D4C4 DD60 0D66 F65A 8EFC 511E 18F3 685C 0022 BFF3
pgp.mit.edu http://pgp.mit.edu/pks/lookup?op=get&search=0x18F3685C0022BFF3

@mpe

This comment has been minimized.

Copy link

mpe commented May 5, 2015

Actually it's saying that it's running without the sandbox enabled. What that means is that the renderer (ie. the process that draws web pages), is running with more permissions than it usually would. That means a bug in the renderer is more likely to lead to your kernel being exploited than if you are running with the sandbox enabled.

@jessfraz

This comment has been minimized.

Copy link
Owner

jessfraz commented May 5, 2015

the old setuid sandbox is the one that doesnt work the new namespace sandbox is the one that does because it uses userns

@mpe

This comment has been minimized.

Copy link

mpe commented May 6, 2015

It's not /dev/dri that's the problem, it's that chrome can't create a new name space for the sandbox:

Failed to move to new namespace: PID namespaces supported, Network namespace supported, but failed: errno = Operation not permitted

You can fix that by using --cap-add=CAP_SYS_ADMIN.

eg:

$ docker run --cap-add=SYS_ADMIN -e DISPLAY --net=host -u michael -it mpee/chrome chromium-browser
/usr/bin/chromium-browser: line 77: lsmod: command not found

(chromium-browser:1): GLib-GIO-CRITICAL **: g_settings_schema_source_lookup: assertion 'source != NULL' failed
libGL error: failed to open drm device: No such file or directory
libGL error: failed to load driver: i965
ATTENTION: default value of option force_s3tc_enable overridden by environment.
[37:37:0506/053009:ERROR:sandbox_linux.cc(325)] InitializeSandbox() called with multiple threads in process gpu-process

Notice it still can't open the DRI device (libGL errors), but it's not complaining about the sandbox. Not sure what the last sandbox error is.

@jessfraz

This comment has been minimized.

Copy link
Owner

jessfraz commented May 6, 2015

Ya but if you don't want it to kill pages every 2 minutes with the sandbox,
then you gotta have /dev/dri also I don't run privileged or add
CAP_SYSADMIN, I've never seen the namespace error

looks like you might not have the ability to clone_newuser

On Tuesday, May 5, 2015, Michael Ellerman notifications@github.com wrote:

It's not /dev/dri that's the problem, it's that chrome can't create a new
name space for the sandbox:

Failed to move to new namespace: PID namespaces supported, Network namespace supported, but failed: errno = Operation not permitted

You can fix that by using --cap-add=CAP_SYS_ADMIN.

eg:

$ docker run --cap-add=SYS_ADMIN -e DISPLAY --net=host -u michael -it mpee/chrome chromium-browser
/usr/bin/chromium-browser: line 77: lsmod: command not found

(chromium-browser:1): GLib-GIO-CRITICAL **: g_settings_schema_source_lookup: assertion 'source != NULL' failed
libGL error: failed to open drm device: No such file or directory
libGL error: failed to load driver: i965
ATTENTION: default value of option force_s3tc_enable overridden by environment.
[37:37:0506/053009:ERROR:sandbox_linux.cc(325)] InitializeSandbox() called with multiple threads in process gpu-process

Notice it still can't open the DRI device (libGL errors), but it's not
complaining about the sandbox. Not sure what the last sandbox error is.


Reply to this email directly or view it on GitHub
#17 (comment)
.

Jessie Frazelle
4096R / D4C4 DD60 0D66 F65A 8EFC 511E 18F3 685C 0022 BFF3
pgp.mit.edu http://pgp.mit.edu/pks/lookup?op=get&search=0x18F3685C0022BFF3

@jessfraz

This comment has been minimized.

Copy link
Owner

jessfraz commented May 6, 2015

My current file works for me without the --no-sandbox flag and with
--device /dev/dri

On Tuesday, May 5, 2015, Jessica Frazelle me@jessfraz.com wrote:

Ya but if you don't want it to kill pages every 2 minutes with the
sandbox, then you gotta have /dev/dri also I don't run privileged or add
CAP_SYSADMIN, I've never seen the namespace error

On Tuesday, May 5, 2015, Michael Ellerman <notifications@github.com
javascript:_e(%7B%7D,'cvml','notifications@github.com');> wrote:

It's not /dev/dri that's the problem, it's that chrome can't create a
new name space for the sandbox:

Failed to move to new namespace: PID namespaces supported, Network namespace supported, but failed: errno = Operation not permitted

You can fix that by using --cap-add=CAP_SYS_ADMIN.

eg:

$ docker run --cap-add=SYS_ADMIN -e DISPLAY --net=host -u michael -it mpee/chrome chromium-browser
/usr/bin/chromium-browser: line 77: lsmod: command not found

(chromium-browser:1): GLib-GIO-CRITICAL **: g_settings_schema_source_lookup: assertion 'source != NULL' failed
libGL error: failed to open drm device: No such file or directory
libGL error: failed to load driver: i965
ATTENTION: default value of option force_s3tc_enable overridden by environment.
[37:37:0506/053009:ERROR:sandbox_linux.cc(325)] InitializeSandbox() called with multiple threads in process gpu-process

Notice it still can't open the DRI device (libGL errors), but it's not
complaining about the sandbox. Not sure what the last sandbox error is.


Reply to this email directly or view it on GitHub
#17 (comment)
.

Jessie Frazelle
4096R / D4C4 DD60 0D66 F65A 8EFC 511E 18F3 685C 0022 BFF3
pgp.mit.edu
http://pgp.mit.edu/pks/lookup?op=get&search=0x18F3685C0022BFF3

Jessie Frazelle
4096R / D4C4 DD60 0D66 F65A 8EFC 511E 18F3 685C 0022 BFF3
pgp.mit.edu http://pgp.mit.edu/pks/lookup?op=get&search=0x18F3685C0022BFF3

@mpe

This comment has been minimized.

Copy link

mpe commented May 6, 2015

OK, I'm using chromium and starting with ubuntu:15.04 so that might explain the differences. I would not recommend anyone run with --no-sandbox.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.