Dockerized chrome sandbox problem
brunetto opened this issue · comments
It seems chrome is not able to run with sandbox. It suggests to recompile with that option.
[1:1:0426/110158:ERROR:browser_main_loop.cc(171)] Running without the SUID sandbox! See https://code.google.com/p/chromium/wiki/LinuxSUIDSandboxDevelopment for more information on developing with the sandbox on.
May be is there another workaround?
It's just a warning it works regardless they are even depreciatinng the suid sandbox in favor of the one w userns
On Sunday, April 26, 2015, brunetto notifications@github.com wrote:
It seems chrome is not able to run with sandbox. It suggests to recompile
with that option.[1:1:0426/110158:ERROR:browser_main_loop.cc(171)] Running without the SUID sandbox! See https://code.google.com/p/chromium/wiki/LinuxSUIDSandboxDevelopment for more information on developing with the sandbox on.
May be is there another workaround?
—
Reply to this email directly or view it on GitHub
#17.
Jessie Frazelle
4096R / D4C4 DD60 0D66 F65A 8EFC 511E 18F3 685C 0022 BFF3
pgp.mit.edu http://pgp.mit.edu/pks/lookup?op=get&search=0x18F3685C0022BFF3
Actually it's saying that it's running without the sandbox enabled. What that means is that the renderer (ie. the process that draws web pages), is running with more permissions than it usually would. That means a bug in the renderer is more likely to lead to your kernel being exploited than if you are running with the sandbox enabled.
the old setuid sandbox is the one that doesnt work the new namespace sandbox is the one that does because it uses userns
It's not /dev/dri that's the problem, it's that chrome can't create a new name space for the sandbox:
Failed to move to new namespace: PID namespaces supported, Network namespace supported, but failed: errno = Operation not permitted
You can fix that by using --cap-add=CAP_SYS_ADMIN.
eg:
$ docker run --cap-add=SYS_ADMIN -e DISPLAY --net=host -u michael -it mpee/chrome chromium-browser
/usr/bin/chromium-browser: line 77: lsmod: command not found
(chromium-browser:1): GLib-GIO-CRITICAL **: g_settings_schema_source_lookup: assertion 'source != NULL' failed
libGL error: failed to open drm device: No such file or directory
libGL error: failed to load driver: i965
ATTENTION: default value of option force_s3tc_enable overridden by environment.
[37:37:0506/053009:ERROR:sandbox_linux.cc(325)] InitializeSandbox() called with multiple threads in process gpu-process
Notice it still can't open the DRI device (libGL errors), but it's not complaining about the sandbox. Not sure what the last sandbox error is.
Ya but if you don't want it to kill pages every 2 minutes with the sandbox,
then you gotta have /dev/dri also I don't run privileged or add
CAP_SYSADMIN, I've never seen the namespace error
looks like you might not have the ability to clone_newuser
On Tuesday, May 5, 2015, Michael Ellerman notifications@github.com wrote:
It's not /dev/dri that's the problem, it's that chrome can't create a new
name space for the sandbox:Failed to move to new namespace: PID namespaces supported, Network namespace supported, but failed: errno = Operation not permitted
You can fix that by using --cap-add=CAP_SYS_ADMIN.
eg:
$ docker run --cap-add=SYS_ADMIN -e DISPLAY --net=host -u michael -it mpee/chrome chromium-browser
/usr/bin/chromium-browser: line 77: lsmod: command not found(chromium-browser:1): GLib-GIO-CRITICAL **: g_settings_schema_source_lookup: assertion 'source != NULL' failed
libGL error: failed to open drm device: No such file or directory
libGL error: failed to load driver: i965
ATTENTION: default value of option force_s3tc_enable overridden by environment.
[37:37:0506/053009:ERROR:sandbox_linux.cc(325)] InitializeSandbox() called with multiple threads in process gpu-processNotice it still can't open the DRI device (libGL errors), but it's not
complaining about the sandbox. Not sure what the last sandbox error is.—
Reply to this email directly or view it on GitHub
#17 (comment)
.
Jessie Frazelle
4096R / D4C4 DD60 0D66 F65A 8EFC 511E 18F3 685C 0022 BFF3
pgp.mit.edu http://pgp.mit.edu/pks/lookup?op=get&search=0x18F3685C0022BFF3
My current file works for me without the --no-sandbox flag and with
--device /dev/dri
On Tuesday, May 5, 2015, Jessica Frazelle me@jessfraz.com wrote:
Ya but if you don't want it to kill pages every 2 minutes with the
sandbox, then you gotta have /dev/dri also I don't run privileged or add
CAP_SYSADMIN, I've never seen the namespace errorOn Tuesday, May 5, 2015, Michael Ellerman <notifications@github.com
javascript:_e(%7B%7D,'cvml','notifications@github.com');> wrote:It's not /dev/dri that's the problem, it's that chrome can't create a
new name space for the sandbox:Failed to move to new namespace: PID namespaces supported, Network namespace supported, but failed: errno = Operation not permitted
You can fix that by using --cap-add=CAP_SYS_ADMIN.
eg:
$ docker run --cap-add=SYS_ADMIN -e DISPLAY --net=host -u michael -it mpee/chrome chromium-browser
/usr/bin/chromium-browser: line 77: lsmod: command not found(chromium-browser:1): GLib-GIO-CRITICAL **: g_settings_schema_source_lookup: assertion 'source != NULL' failed
libGL error: failed to open drm device: No such file or directory
libGL error: failed to load driver: i965
ATTENTION: default value of option force_s3tc_enable overridden by environment.
[37:37:0506/053009:ERROR:sandbox_linux.cc(325)] InitializeSandbox() called with multiple threads in process gpu-processNotice it still can't open the DRI device (libGL errors), but it's not
complaining about the sandbox. Not sure what the last sandbox error is.—
Reply to this email directly or view it on GitHub
#17 (comment)
.Jessie Frazelle
4096R / D4C4 DD60 0D66 F65A 8EFC 511E 18F3 685C 0022 BFF3
pgp.mit.edu
http://pgp.mit.edu/pks/lookup?op=get&search=0x18F3685C0022BFF3
Jessie Frazelle
4096R / D4C4 DD60 0D66 F65A 8EFC 511E 18F3 685C 0022 BFF3
pgp.mit.edu http://pgp.mit.edu/pks/lookup?op=get&search=0x18F3685C0022BFF3
OK, I'm using chromium and starting with ubuntu:15.04 so that might explain the differences. I would not recommend anyone run with --no-sandbox.