[GH-ISSUE #3586] element-desktop: program does not start (--no-sandbox) #2250

Open
opened 2026-05-05 08:56:30 -06:00 by gitea-mirror · 17 comments
Owner

Originally created by @reinerh on GitHub (Aug 14, 2020).
Original GitHub issue: https://github.com/netblue30/firejail/issues/3586

I received a bug report that element-desktop is not starting with firejail (0.9.62) and was able to reproduce it.
The problem (at least for me) was "nodbus" from electron.profile.
With "ignore nodbus" it's successfully starting.

With the new dbus changes in master I'm currently not sure what the best fix would be.
"ignore dbus-user" and "ignore dbus-system", or is there a better way to allow narrower dbus access?

Originally created by @reinerh on GitHub (Aug 14, 2020). Original GitHub issue: https://github.com/netblue30/firejail/issues/3586 I received a [bug report](https://bugs.debian.org/968382) that element-desktop is not starting with firejail (0.9.62) and was able to reproduce it. The problem (at least for me) was "nodbus" from electron.profile. With "ignore nodbus" it's successfully starting. With the new dbus changes in master I'm currently not sure what the best fix would be. "ignore dbus-user" and "ignore dbus-system", or is there a better way to allow narrower dbus access?
Author
Owner

@bbhtt commented on GitHub (Aug 14, 2020):

It launches fine under current profiles of 0.9.62.2-1 (Ubuntu groovy proposed) without ignore nodbus.

This

50:0814/095134.384213:FATAL:platform_shared_memory_region_posix.cc(254)] This is frequently caused by incorrect permissions on /dev/shm.  Try 'sudo chmod 1777 /dev/shm' to fix.

appears only when --no-sandbox is used and even with ignore nodbus included in Element profile it doesn't launch with --no-sandbox flag (the screen stays white).

Element 1.7.3...

Edit. Even with /usr/bin/element-desktop --no-sandbox same output and same white screen. https://github.com/vector-im/element-web/issues/13171#issuecomment-650806459

<!-- gh-comment-id:674050601 --> @bbhtt commented on GitHub (Aug 14, 2020): It launches fine under current profiles of 0.9.62.2-1 (Ubuntu groovy proposed) _without_ `ignore nodbus`. This ``` 50:0814/095134.384213:FATAL:platform_shared_memory_region_posix.cc(254)] This is frequently caused by incorrect permissions on /dev/shm. Try 'sudo chmod 1777 /dev/shm' to fix. ``` appears only when `--no-sandbox` is used and even with `ignore nodbus` included in Element profile it doesn't launch with `--no-sandbox` flag (the screen stays white). Element 1.7.3... Edit. Even with `/usr/bin/element-desktop --no-sandbox` same output and same white screen. https://github.com/vector-im/element-web/issues/13171#issuecomment-650806459
Author
Owner

@reinerh commented on GitHub (Aug 14, 2020):

Sorry, I forgot to mention that --no-sandbox is used.

<!-- gh-comment-id:674051724 --> @reinerh commented on GitHub (Aug 14, 2020): Sorry, I forgot to mention that `--no-sandbox` is used.
Author
Owner

@reinerh commented on GitHub (Aug 14, 2020):

@kortewegdevries I also see the white screen after starting.
But with nodbus it's not even fully starting up here (there is no tray icon). Did you observe the same?

<!-- gh-comment-id:674095814 --> @reinerh commented on GitHub (Aug 14, 2020): @kortewegdevries I also see the white screen after starting. But with `nodbus` it's not even fully starting up here (there is no tray icon). Did you observe the same?
Author
Owner

@bbhtt commented on GitHub (Aug 14, 2020):

@kortewegdevries I also see the white screen after starting.
But with nodbus it's not even fully starting up here (there is no tray icon). Did you observe the same?

No in my case (Ubuntu, with no change in profiles) it starts in tray, doesn't expand to windowed/full screen until toggled from tray and stays white thereafter.

Does it not run under firejail without that flag in Debian?

<!-- gh-comment-id:674110479 --> @bbhtt commented on GitHub (Aug 14, 2020): > @kortewegdevries I also see the white screen after starting. > But with `nodbus` it's not even fully starting up here (there is no tray icon). Did you observe the same? No in my case (Ubuntu, with no change in profiles) it starts in tray, doesn't expand to windowed/full screen until toggled from tray and stays white thereafter. Does it not run under firejail without that flag in Debian?
Author
Owner

@reinerh commented on GitHub (Aug 14, 2020):

It might be related to my window manager, but with nodbus I don't get any tray icon (so I can't open the element window).

(element-desktop:12): libappindicator-WARNING **: 10:20:24.734: Unable to get the session bus: Could not connect: No such file or directory

(element-desktop:12): LIBDBUSMENU-GLIB-WARNING **: 10:20:24.734: Unable to get session bus: Could not connect: No such file or directory

But maybe there is also a different issue, as the bug reporter had different messages.

<!-- gh-comment-id:674148447 --> @reinerh commented on GitHub (Aug 14, 2020): It might be related to my window manager, but with `nodbus` I don't get any tray icon (so I can't open the element window). > (element-desktop:12): libappindicator-WARNING **: 10:20:24.734: Unable to get the session bus: Could not connect: No such file or directory > > (element-desktop:12): LIBDBUSMENU-GLIB-WARNING **: 10:20:24.734: Unable to get session bus: Could not connect: No such file or directory But maybe there is also a different issue, as the bug reporter had different messages.
Author
Owner

@bbhtt commented on GitHub (Aug 14, 2020):

Those two messages appear for me regardless of --no-sandbox under firejail; I don't know if they are harmless or actually break some functionality (I don't use element), I'm under Xfce...

<!-- gh-comment-id:674160817 --> @bbhtt commented on GitHub (Aug 14, 2020): Those two messages appear for me regardless of `--no-sandbox` under firejail; I don't know if they are harmless or actually break some functionality (I don't use element), I'm under Xfce...
Author
Owner

@bbhtt commented on GitHub (Aug 18, 2020):

Opened 14982 on element-web regarding this... from the recent update of Element 1.7.4 the tray icon has gone...

<!-- gh-comment-id:675559086 --> @bbhtt commented on GitHub (Aug 18, 2020): Opened 14982 on element-web regarding this... from the recent update of Element 1.7.4 the tray icon has gone...
Author
Owner

@rusty-snake commented on GitHub (Aug 24, 2020):

Tray icon would be the following AFAIK, see #3540.

dbus-user filter
dbus-user.talk org.freedesktop.StatusNotifierItem
dbus-user.talk org.kde.StatusNotifierWatcher
<!-- gh-comment-id:679240179 --> @rusty-snake commented on GitHub (Aug 24, 2020): Tray icon would be the following AFAIK, see #3540. ``` dbus-user filter dbus-user.talk org.freedesktop.StatusNotifierItem dbus-user.talk org.kde.StatusNotifierWatcher ```
Author
Owner

@bbhtt commented on GitHub (Aug 25, 2020):

No, I meant it doesn't even show without firejail, and I was testing it on 0.9.62.4-2 (is it?)... Debian people can't launch element under firejail... this is a chromium bug since version 80/81.something, the chromium bug tracker has an issue, they suggested --no-xshm. --ignore-gpu-blacklist, env variables etc. none of which work for me when used with --no-sandbox on Ubuntu groovy/Debian bullseye withwithout firejail.

People using Ubuntu can launch it fine under firejail (0.9.62.4-2) without any modifications, since they don't need to use --no-sandbox, Debian can't...

<!-- gh-comment-id:679951941 --> @bbhtt commented on GitHub (Aug 25, 2020): No, I meant it doesn't even show _without_ firejail, and I was testing it on 0.9.62.4-2 (is it?)... Debian people can't launch element under firejail... this is a chromium bug since version 80/81.something, the chromium bug tracker has an issue, they suggested --no-xshm. --ignore-gpu-blacklist, env variables etc. none of which work for me when used with --no-sandbox on Ubuntu groovy/Debian bullseye withwithout firejail. People using Ubuntu can launch it fine under firejail (0.9.62.4-2) without any modifications, since they don't need to use --no-sandbox, Debian can't...
Author
Owner

@rusty-snake commented on GitHub (Nov 9, 2020):

still an issue?

<!-- gh-comment-id:724239093 --> @rusty-snake commented on GitHub (Nov 9, 2020): still an issue?
Author
Owner

@reinerh commented on GitHub (Nov 10, 2020):

Unfortunately yes. Checked again with Element 1.7.13:

$ firejail element-desktop
...
[10:1110/113057.289531:FATAL:setuid_sandbox_host.cc(158)] The SUID sandbox helper binary was found, but is not configured correctly. Rather than run without sandboxing I'm aborting now. You need to make sure that /opt/Element/chrome-sandbox is owned by root and has mode 4755.
$ firejail element-desktop --no-sandbox
...
/home/reiner/.config/Element exists: no
/home/reiner/.config/Riot exists: no
Starting auto update with base URL: https://packages.riot.im/desktop/update/
Auto update not supported on this platform

(element-desktop:10): libappindicator-WARNING **: 11:31:44.310: Unable to get the session bus: Could not connect: Permission denied

(element-desktop:10): LIBDBUSMENU-GLIB-WARNING **: 11:31:44.310: Unable to get session bus: Could not connect: Permission denied
[57:1110/113144.388034:FATAL:platform_shared_memory_region_posix.cc(255)] This is frequently caused by incorrect permissions on /dev/shm.  Try 'sudo chmod 1777 /dev/shm' to fix.

(in this case there is not even a tray icon showing up)

After commenting dbus-user none in electron.profile (used by the Element profile):

$ firejail element-desktop --no-sandbox
...
/home/reiner/.config/Element exists: no
/home/reiner/.config/Riot exists: no
Starting auto update with base URL: https://packages.riot.im/desktop/update/
Auto update not supported on this platform
[56:1110/113309.295246:FATAL:platform_shared_memory_region_posix.cc(255)] This is frequently caused by incorrect permis

The tray icon is now showing up, and you can open the main window. But the window only stays white.

Edit: The last issue (white window) also happens without firejail (i.e. only element-desktop --no-sandbox). So I think that's an Electron issue. But the firejail profile should maybe not prevent access to dbus, as this seems to be used for tray icon creation.
I can run Element only without firejail and without --no-sandbox successfully.

<!-- gh-comment-id:724616194 --> @reinerh commented on GitHub (Nov 10, 2020): Unfortunately yes. Checked again with Element 1.7.13: ``` $ firejail element-desktop ... [10:1110/113057.289531:FATAL:setuid_sandbox_host.cc(158)] The SUID sandbox helper binary was found, but is not configured correctly. Rather than run without sandboxing I'm aborting now. You need to make sure that /opt/Element/chrome-sandbox is owned by root and has mode 4755. ``` ``` $ firejail element-desktop --no-sandbox ... /home/reiner/.config/Element exists: no /home/reiner/.config/Riot exists: no Starting auto update with base URL: https://packages.riot.im/desktop/update/ Auto update not supported on this platform (element-desktop:10): libappindicator-WARNING **: 11:31:44.310: Unable to get the session bus: Could not connect: Permission denied (element-desktop:10): LIBDBUSMENU-GLIB-WARNING **: 11:31:44.310: Unable to get session bus: Could not connect: Permission denied [57:1110/113144.388034:FATAL:platform_shared_memory_region_posix.cc(255)] This is frequently caused by incorrect permissions on /dev/shm. Try 'sudo chmod 1777 /dev/shm' to fix. ``` (in this case there is not even a tray icon showing up) After commenting `dbus-user none` in electron.profile (used by the Element profile): ``` $ firejail element-desktop --no-sandbox ... /home/reiner/.config/Element exists: no /home/reiner/.config/Riot exists: no Starting auto update with base URL: https://packages.riot.im/desktop/update/ Auto update not supported on this platform [56:1110/113309.295246:FATAL:platform_shared_memory_region_posix.cc(255)] This is frequently caused by incorrect permis ``` The tray icon is now showing up, and you can open the main window. But the window only stays white. Edit: The last issue (white window) also happens without firejail (i.e. only `element-desktop --no-sandbox`). So I think that's an Electron issue. But the firejail profile should maybe not prevent access to dbus, as this seems to be used for tray icon creation. I can run Element only without firejail and without `--no-sandbox` successfully.
Author
Owner

@bbhtt commented on GitHub (Nov 11, 2020):

For this error when doing firejail <electron-app>

[14:0611/105406.114486:FATAL:setuid_sandbox_host.cc(157)] The SUID sandbox helper binary was found, but is not configured correctly. Rather than run without sandboxing I'm aborting now. You need to make sure that /usr/share/atom/chrome-sandbox is owned by root and has mode 4755.

I don't think workarounds like these cb67995230, force nonewprivs, seccomp, syscall etc. work with more recent electron versions (tested with element-desktop on Debian; which uses electron 10.1.3 I think). This won't be restricted to element-desktop only once respective developers starts gradually bumping their electron versions.

Then you are forced to use firejail <electron-app> --no-sandbox which now again doesn't work:

[57:1110/113144.388034:FATAL:platform_shared_memory_region_posix.cc(255)] This is frequently caused by incorrect permissions on /dev/shm.  Try 'sudo chmod 1777 /dev/shm' to fix.

So baseline (1) turn the sysctl knob + use firejail, or (2) use those electron apps without firejail and rely on chromium's sandbox. In that case I recommend adding a wiki/sticky entry noting the implications of turning the sysctl knob for unpriv user ns clone, --no-sandbox or relying on chromium sandbox vs. firejail from a functional perspective. See here https://github.com/netblue30/firejail/issues/1347 and here https://github.com/netblue30/firejail/issues/554.

Chromium: https://bugs.chromium.org/p/chromium/issues/detail?id=1035803
Electron: https://github.com/electron/electron/issues/22775#issuecomment-616023334 (None of the workarounds work; only works in the remote x session case.)

<!-- gh-comment-id:725232608 --> @bbhtt commented on GitHub (Nov 11, 2020): For this error when doing `firejail <electron-app>` ``` [14:0611/105406.114486:FATAL:setuid_sandbox_host.cc(157)] The SUID sandbox helper binary was found, but is not configured correctly. Rather than run without sandboxing I'm aborting now. You need to make sure that /usr/share/atom/chrome-sandbox is owned by root and has mode 4755. ``` I don't think workarounds like these https://github.com/netblue30/firejail/commit/cb6799523085ddc7caf57b235514e6865a4caeaa, force nonewprivs, seccomp, syscall etc. work with more recent electron versions (tested with element-desktop on Debian; which uses electron 10.1.3 I think). This won't be restricted to element-desktop only once respective developers starts gradually bumping their electron versions. Then you are forced to use `firejail <electron-app> --no-sandbox` which now again doesn't work: ``` [57:1110/113144.388034:FATAL:platform_shared_memory_region_posix.cc(255)] This is frequently caused by incorrect permissions on /dev/shm. Try 'sudo chmod 1777 /dev/shm' to fix. ``` So baseline (1) turn the sysctl knob + use firejail, or (2) use those electron apps without firejail and rely on chromium's sandbox. In that case I recommend adding a wiki/sticky entry noting the implications of turning the sysctl knob for unpriv user ns clone, `--no-sandbox` or relying on chromium sandbox vs. firejail from a functional perspective. See here https://github.com/netblue30/firejail/issues/1347 and here https://github.com/netblue30/firejail/issues/554. Chromium: https://bugs.chromium.org/p/chromium/issues/detail?id=1035803 Electron: https://github.com/electron/electron/issues/22775#issuecomment-616023334 (None of the workarounds work; only works in the remote x session case.)
Author
Owner

@bbhtt commented on GitHub (Dec 14, 2020):

So baseline (1) turn the sysctl knob + use firejail,

See https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=898446#117 a381917851

Once the kernel comes I'll check it and also Element is using electron 11 now.

<!-- gh-comment-id:744189883 --> @bbhtt commented on GitHub (Dec 14, 2020): > So baseline (1) turn the sysctl knob + use firejail, See https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=898446#117 https://salsa.debian.org/kernel-team/linux/-/commit/a381917851e762684ebe28e04c5ae0d8be7f42c7 Once the kernel comes I'll check it and also Element is using electron 11 now.
Author
Owner

@rusty-snake commented on GitHub (Jan 4, 2021):

$ firejail element-desktop
...
[10:1110/113057.289531:FATAL:setuid_sandbox_host.cc(158)] The SUID sandbox helper binary was found, but is not configured correctly. Rather than run without sandboxing I'm aborting now. You need to make sure that /opt/Element/chrome-sandbox is owned by root and has mode 4755.

Fixed by #3807.

The tray icon is now showing up,

Tray-icon researches: #3774.
However element-desktop is now affected by #1137 if I'm right.

<!-- gh-comment-id:753942728 --> @rusty-snake commented on GitHub (Jan 4, 2021): > ``` > $ firejail element-desktop > ... > [10:1110/113057.289531:FATAL:setuid_sandbox_host.cc(158)] The SUID sandbox helper binary was found, but is not configured correctly. Rather than run without sandboxing I'm aborting now. You need to make sure that /opt/Element/chrome-sandbox is owned by root and has mode 4755. > ``` Fixed by #3807. > The tray icon is now showing up, Tray-icon researches: #3774. However element-desktop is now affected by #1137 if I'm right.
Author
Owner

@reinerh commented on GitHub (Jan 4, 2021):

$ firejail element-desktop
...
[10:1110/113057.289531:FATAL:setuid_sandbox_host.cc(158)] The SUID sandbox helper binary was found, but is not configured correctly. Rather than run without sandboxing I'm aborting now. You need to make sure that /opt/Element/chrome-sandbox is owned by root and has mode 4755.

Fixed by #3807.

With kernel.unprivileged_userns_clone = 0 it still does not want to start in firejail:

The setuid sandbox is not running as root. Common causes:

  • An unprivileged process using ptrace on it, like a debugger.
  • A parent process set prctl(PR_SET_NO_NEW_PRIVS, ...)
    Failed to move to new namespace: PID namespaces supported, Network namespace supported, but failed: errno = Operation not permitted

After setting kernel.unprivileged_userns_clone to 1, it's successfully starting up, and even the tray icon is showing up here.
Thanks a lot for your work on that!

However element-desktop is now affected by #1137 if I'm right.

I can't confirm that here. Tray icon still works fine with private-tmp.

<!-- gh-comment-id:754106903 --> @reinerh commented on GitHub (Jan 4, 2021): > > ``` > > $ firejail element-desktop > > ... > > [10:1110/113057.289531:FATAL:setuid_sandbox_host.cc(158)] The SUID sandbox helper binary was found, but is not configured correctly. Rather than run without sandboxing I'm aborting now. You need to make sure that /opt/Element/chrome-sandbox is owned by root and has mode 4755. > > ``` > > Fixed by #3807. With `kernel.unprivileged_userns_clone = 0` it still does not want to start in firejail: > The setuid sandbox is not running as root. Common causes: > * An unprivileged process using ptrace on it, like a debugger. > * A parent process set prctl(PR_SET_NO_NEW_PRIVS, ...) > Failed to move to new namespace: PID namespaces supported, Network namespace supported, but failed: errno = Operation not permitted After setting `kernel.unprivileged_userns_clone` to 1, it's successfully starting up, and even the tray icon is showing up here. Thanks a lot for your work on that! > However element-desktop is now affected by #1137 if I'm right. I can't confirm that here. Tray icon still works fine with `private-tmp`.
Author
Owner

@rusty-snake commented on GitHub (Jan 4, 2021):

$ firejail element-desktop
...
[10:1110/113057.289531:FATAL:setuid_sandbox_host.cc(158)] The SUID sandbox helper binary was found, but is not configured correctly. Rather than run without sandboxing I'm aborting now. You need to make sure that /opt/Element/chrome-sandbox is owned by root and has mode 4755.

Fixed by #3807.

With kernel.unprivileged_userns_clone = 0 it still does not want to start in firejail:

Have you set force-nonewprivs yes?

<!-- gh-comment-id:754116966 --> @rusty-snake commented on GitHub (Jan 4, 2021): > > > ``` > > > $ firejail element-desktop > > > ... > > > [10:1110/113057.289531:FATAL:setuid_sandbox_host.cc(158)] The SUID sandbox helper binary was found, but is not configured correctly. Rather than run without sandboxing I'm aborting now. You need to make sure that /opt/Element/chrome-sandbox is owned by root and has mode 4755. > > > ``` > > > > > > Fixed by #3807. > > > With `kernel.unprivileged_userns_clone = 0` it still does not want to start in firejail: Have you set `force-nonewprivs yes`?
Author
Owner

@reinerh commented on GitHub (Jan 4, 2021):

With kernel.unprivileged_userns_clone = 0 it still does not want to start in firejail:

Have you set force-nonewprivs yes?

No, I have it at default (commented out / disabled).

<!-- gh-comment-id:754118724 --> @reinerh commented on GitHub (Jan 4, 2021): > > With `kernel.unprivileged_userns_clone = 0` it still does not want to start in firejail: > > Have you set `force-nonewprivs yes`? No, I have it at default (commented out / disabled).
Sign in to join this conversation.
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#2250
No description provided.