[Feature] no-sandbox on Linux

[pronebird]

• Version: 21.2.0

• Target: Linux

Since the suid bit fix was recently merged in 7c2881e, I propose adding a noSandbox option to Linux targets which would do the following:

1. Remove the chrome-sandbox before packaging the app.
2. Rename the Electron binary and replace it with a shell script that runs the original binary with --no-sandbox flag.
3. Run chmod 4755 chrome-sandbox conditionally only if compiled with noSandbox: true 7c2881e#diff-90356ee68ca9eb82e7e254a31921a291R7

The current workaround we use for Linux to disable the sandbox:

const path = require('path');
const fs = require('fs');
const builder = require('electron-builder');
const util = require('util');

const renameAsync = util.promisify(fs.rename);
const unlinkAsync = util.promisify(fs.unlink);

builder.build({
    targets: builder.Platform.LINUX.createTarget(),
    config: {
      afterPack: (context) => {
        const sourceExecutable = path.join(context.appOutDir, 'my-app');
        const targetExecutable = path.join(context.appOutDir, 'the-real-app');
        const launcherScript = path.join(context.appOutDir, 'launcher-script.sh');
        const chromeSandbox = path.join(context.appOutDir, 'chrome-sandbox');

        return Promise.all([
          // rename my-app to the-real-app
          renameAsync(sourceExecutable, targetExecutable),

          // rename launcher script to my-app
          renameAsync(launcherScript, sourceExecutable),

          // remove the chrome-sandbox file since we explicitly disable it
          unlinkAsync(chromeSandbox),
        ]);
      },
    },
  });

The launcher shell script looks as following:

#!/usr/bin/env bash
set -eu

SCRIPT_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
exec "$SCRIPT_DIR/the-real-app" --no-sandbox "$@"

[taratatach]

The sandbox can be disabled only when unprivileged user namespaces are disabled in the kernel.

#!/usr/bin/env bash
set -ex

UNPRIVILEGED_USERNS_ENABLED=$(cat /proc/sys/kernel/unprivileged_userns_clone 2>/dev/null)
SCRIPT_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
exec "$SCRIPT_DIR/the-real-app" "$([[ $UNPRIVILEGED_USERNS_ENABLED == 0 ]] && echo '--no-sandbox')" "$@"

[stale]

Is this still relevant? If so, what is blocking it? Is there anything you can do to help move it forward?

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs.