Can't run Chromium in firejail with --overlay-tmpfs option

[laniakea64]

Xubuntu 16.04
firejail 0.9.44.2
Chromium version -

$ chromium-browser --version
Chromium 53.0.2785.143 Built on Ubuntu , running on Ubuntu 16.04

This works -

firejail --noprofile --caps.drop=all chromium-browser --disable-gpu

This, however, does not -

$ firejail --overlay-tmpfs --noprofile chromium-browser --disable-gpu
Parent pid 2351, child pid 2352
OverlayFS configured in /run/firejail/mnt directory
Dropping all Linux capabilities and enforcing default seccomp filter
Warning: failed to unmount /sys
Warning: whitelist feature is disabled in overlay
Child process initialized
[...snipped irrelevant output...]
The setuid sandbox is not running as root. Common causes:
  * An unprivileged process using ptrace on it, like a debugger.
  * A parent process set prctl(PR_SET_NO_NEW_PRIVS, ...)
Failed to move to new namespace: PID namespaces supported, Network namespace supported, but failed: errno = Operation not permitted
[2:2:1225/211042:FATAL:zygote_host_impl_linux.cc(182)] Check failed: ReceiveFixedMessage(fds[0], kZygoteBootMessage, sizeof(kZygoteBootMessage), &boot_pid). 
#0 0x7f36468176ae base::debug::StackTrace::StackTrace()
#1 0x7f364683470e logging::LogMessage::~LogMessage()
#2 0x7f364498f06b content::ZygoteHostImpl::LaunchZygote()
#3 0x7f364498dfc7 content::ZygoteCommunication::Init()
#4 0x7f364498e5be content::CreateZygote()
#5 0x7f3644647abc content::BrowserMainLoop::EarlyInitialization()
#6 0x7f364464b051 <unknown>
#7 0x7f3644643863 content::BrowserMain()
#8 0x7f36445b3f4d <unknown>
#9 0x7f36445b3141 content::ContentMain()
#10 0x55580b11619a ChromeMain
#11 0x7f363b0b7830 __libc_start_main
#12 0x55580b116049 _start


Parent is shutting down, bye...

This also fails in firejail 0.9.38.

In Lubuntu 14.04, this still fails under firejail 0.9.44.2. But there it works fine in firejail 0.9.38.

How to get Chromium to run in firejail 0.9.44.2 with the --overlay-tmpfs option?

[netblue30]

I'll put a fix in.

[netblue30]

All fixed in git.

[laniakea64]

Unfortunately can't try it out due to build failure -

for file in contrib/*; do \
                install -c -m 0755 $file debian//usr/lib/firejail/.; \
        done
install: cannot stat ‘contrib/*’: No such file or directory
make[2]: *** [realinstall] Error 1
make[2]: Leaving directory `/srv/fjx/firejail/firejail-0.9.45'
make[1]: *** [install-strip] Error 2
make[1]: Leaving directory `/srv/fjx/firejail/firejail-0.9.45'
*****************************************
install size 568        firejail-0.9.45/debian
*****************************************
mv: cannot stat ‘firejail-0.9.45/debian/usr/share/doc/firejail/RELNOTES’: No such file or directory
gzip: firejail-0.9.45/debian/usr/share/doc/firejail/changelog.Debian: No such file or directory
rm: cannot remove ‘firejail-0.9.45/debian/usr/share/doc/firejail/COPYING’: No such file or directory
cp: cannot create regular file ‘firejail-0.9.45/debian/usr/share/doc/firejail/.’: No such file or directory
dpkg-deb: error: conffile `/etc/firejail/0ad.profile' does not appear in package
warning: cannot find binary, udeb or source package debian.deb in lab (skipping)
mv: cannot stat ‘debian.deb’: No such file or directory
if building a 32bit package, rename the deb file manually

[netblue30]

Fixed, problem in the Makefile.in.

[laniakea64]

Thanks!

In 14.04, Chromium now does run with --overlay-tmpfs.

Still fails in 16.04 though, same error as before. 🙁

[netblue30]

It's possible, I only tested it here on Debian stable. I'll give it a try on 16.04.

[netblue30]

Sorry I had to drop this, there are some security issues. For now, OverlayFS will require seccomp, and seccomp will prevent Chromium from starting.

[laniakea64]

Thank you for letting me know.

I tried building the latest firejail with the --disable-seccomp configure flag. And oddly, it didn't work there either.

Anyway, I may have found a workaround -

$ firejail --overlay-tmpfs --noprofile chromium-browser --disable-gpu --no-sandbox

Do I lose out on anything this way?

[netblue30]

You will still have seccomp enabled, it is just moved from chromium process to firejail process.

It is very difficult to say what is the best place for seccomp to be. In both cases there are advantages and disadvantages.