Bundled engine: probe that it can start before using it; install the AppArmor userns profile on Ubuntu - #108
Merged
Merged
Conversation
…AppArmor userns profile on Ubuntu First launch after v3.13.0 on bonita crashed in ZygoteHostImpl::Init (SIGTRAP): Ubuntu 23.10+ blocks unprivileged user namespaces through AppArmor, so a Chromium that is not a distro package cannot set up its sandbox and aborts with No usable sandbox. The Flatpak never hit it (bwrap has its own allowance) and the container test hid it (--no-sandbox). Two fixes. The launcher now runs a throwaway headless start of the bundled engine once per engine version (engine_usable), remembers success in engine/.usable, and on failure falls through to a system or Flatpak Ungoogled Chromium with a note saying why; a missing library or missing profile is a fallback, never a crash. And install.sh writes /etc/apparmor.d/tronbrowser-engine, granting userns to the engine binary path, with one sudo when the kernel restricts user namespaces (Chromium docs/security/apparmor-userns-restrictions.md; the same mechanism Ubuntu uses for its own browsers), on install and on tron upgrade, skipped where the kernel does not restrict, with a plain warning and the retry command when no sudo is available. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
ThreatCrush Security Scan56 finding(s) HIGH/CRITICAL: 3 | MEDIUM: 33 | LOW: 20
…and 6 more. Full results in the Security tab. Snippets are redacted; ThreatCrush never prints matched credential material. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
First launch after v3.13.0 on bonita crashed:
chromeSIGTRAP inZygoteHostImpl::Init. That is Chromium's "No usable sandbox!" fatal. Ubuntu 23.10+ setskernel.apparmor_restrict_unprivileged_userns=1, which blocks the user namespaces Chromium's sandbox needs unless an AppArmor profile grants them to the binary. Ubuntu ships such profiles for its own browsers (/etc/apparmor.d/chrome); a third-party engine must bring its own. The Flatpak never hit this (bwrap has its own allowance) and the container test hid it (--no-sandbox).Fix
engine_usable: before choosing the bundled engine, run a throwaway headless start (--headless=new --dump-dom about:blank, temp profile, 25 s cap) once per engine version and remember success inengine/.usable. On failure fall through to a system or Flatpak Ungoogled Chromium and say why on stderr, with the userns hint when the kernel restricts it. A missing library or a missing profile is a fallback, never a crash.ensure_engine_sandbox: when the kernel restricts unprivileged userns, write/etc/apparmor.d/tronbrowser-engine(Chromium'sdocs/security/apparmor-userns-restrictions.mdform:profile tronbrowser-engine <engine path> flags=(unconfined) { userns, }) with onesudoand load it withapparmor_parser -r -T -W. Runs fromensure_engineon install and ontron upgrade, both after a download and when the engine is already current, so an engine installed by v3.13.0 gets its profile on the next upgrade. Skipped where the kernel does not restrict. Without sudo it warns and prints the retry (… | sh -s -- ensure-engine). Clearsengine/.usableso the launcher re-probes.Verified
engine_usablewith fake engines: starts → usable, cache written; cache honoured while VERSION unchanged even if the binary now crashes; VERSION bump re-probes; crashing engine → not usable, no cache, message with the userns hint (this box is Ubuntu 26.04 with the restriction on); missing dir → not usable.ensure_engine_sandbox: profile already present for the path → no-op; no sudo → warning + return 1; the generated profile parses withapparmor_parser -Q -T.sh -non launcher and installer.Not run on bonita: the sudo path needs a terminal there.
tron upgradewill prompt once.🤖 Generated with Claude Code