keybase / keybase/client

Setuid error when clicking any links

Open
#18,969 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Go
Stars
9.2k
Forks
1.3k
Avg merge
12h 58m
Merged PRs (30d)
56

Description

Error in question:

Aug 16 03:23:31 hostname Keybase[17714]: The setuid sandbox is not running as root. Common causes:
Aug 16 03:23:31 hostname Keybase[17714]:   * An unprivileged process using ptrace on it, like a debugger.
Aug 16 03:23:31 hostname Keybase[17714]:   * A parent process set prctl(PR_SET_NO_NEW_PRIVS, ...)
Aug 16 03:23:31 hostname Keybase[17714]: Failed to move to new namespace: PID namespaces supported, Network namespace supported, but failed: errno = Operation not permitted

Had to determine why debian-alternatives was having no effect on the browser utilized.
Determined that this was because xdg-settings' default-web-browser was set to firefox-esr.desktop
Modified this to google-chrome.desktop
Browser now fails to open with the above error in logs
xdg-open https://google.com opens chrome

If files are needed, please let me know.

EDIT1:

Clarifying test 1:

  1. Copied (default) google-chrome.desktop to keybae-chrome.desktop
  2. Removed all but the following:
[Desktop Entry]
Version=1.0
Name=Google Chrome
GenericName=Web Browser
Exec=/usr/bin/google-chrome-stable %U
StartupNotify=true
Terminal=false
Icon=google-chrome
Type=Application
Categories=Network;WebBrowser;
MimeType=text/html;text/xml;application/xhtml_xml;image/webp;x-scheme-handler/http;x-scheme-handler/https;x-scheme-handler/ftp;
  1. xdg-settings set default-www-browser keybae-chrome.desktop
  2. xdg-open http://google.com [[This works]]
  3. run_keybase
  4. Open wallet, navigate to trustlines, open any exchange
    [[Failure - same error as before]]

Clarifying test 2, sanity check edition:

  1. Identical to above, except:
  2. /usr/bin/google-chrome-stable --> /usr/bin/firefox-esr
    [[Success, opens link in firefox]]

EDIT2:

My i-have-almost-no-xp guess is that this may relate to a safety mechanism of the chrome sandbox to prevent escalation?

Perhaps #18897 may have some bearing?

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the failure from the Keybase wallet's trustlines flow with Google Chrome configured through xdg-settings, then compare it with the working Firefox configuration. The payload names no source files or tests, so locate the entry point that opens external links and determine why Chrome's setuid sandbox fails. Done means links open successfully in Chrome without the reported sandbox error.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
desktop
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.