sandbox error laucnhing AppImage applications

[PsySc0rpi0n]

Hello.

I've been getting some problems regarding these .AppImage files that seems to be coming more and more used nowadays. But usually these image files are executed in a sandboxed environment.
In my case, I'm trying to launch a password manager and I'm getting the following error:

Code: Select all

$ ./Bitwarden-1.24.6-x86_64.AppImage help
[32371:0217/175059.315220:FATAL:setuid_sandbox_host.cc(157)] The SUID sandbox helper binary was found, but is not configured correctly. Rather than run without sandboxing I'm aborting now. You need to make sure that /tmp/.mount_BitwarlogpeP/chrome-sandbox is owned by root and has mode 4755.
Trace/breakpoint trap

It runs if I give it the switch --no-sandbox but I wanted to use the sandbox environment because, well, if there is one, it should be used.

Any idea how to fix this?

[sunrat]

Did you try the solution suggested in the error message?

[PsySc0rpi0n]

Did you try the solution suggested in the error message?

Yes. Such folder doesn't exist. I think it's a temporary folder that is just deleted when the application is not running, or something like that!

[stevepusser]

Hello.
....

Any idea how to fix this?

Sure, run a Liquorix kernel!

Or I know you can set a Debian kernel so that it won't show the error, either, but I'll let you search for the answer. I know it's the same solution as for Chromium-type browsers like Vivaldi and Brave, because those AppImages are using an Electron bundle inside that includes Chromium as the web language runner thingy.

[PsySc0rpi0n]

Hello.
....

Any idea how to fix this?

Sure, run a Liquorix kernel!

I don't want a Liquorix kernel. I'm no gamer nor even related to multimedia.

Or I know you can set a Debian kernel so that it won't show the error, either, but I'll let you search for the answer. I know it's the same solution as for Chromium-type browsers like Vivaldi and Brave, because those AppImages are using an Electron bundle inside that includes Chromium as the web language runner thingy.

Hum, I don't want to just hide the error. I would like to genuinely fix it.

I understand very little or nothing about what you just said of Electrum bundle and Chromium web language runner.
For me Electrum is a crypto currency wallet. :p

Anyways, setting a Debian kernel so that it won't show the error, is not fixing the error, is only hiding it. If you know of a solution, I would prefer some guidance on it!

Thanks
Psy

[stevepusser]

ELECTRON, I wrote.

I don't think I can help you when you can't even get that right.

It's a commonly asked question, so you need to work on your Google-Fu. It's so common we added the "Chromium Sandboxing kernel fix" to the MX Linux Tweak GUI.

I thought Debian users used it because most things are DIY, not handed to them like in MX...

[stevepusser]

Here's a question today on the MX forum's about why it works OOTB on MX and not other Debian distros that may enlighten you: https://forum.mxlinux.org/viewtopic.php ... 63#p624363

[Head_on_a_Stick]

See also https://docs.appimage.org/user-guide/tr ... oxing.html

The OP should note that enabling kernel.unprivileged_userns_clone exposes a huge attack surface in the kernel, which is why it is disabled by default in Debian.

A better solution may be to run the AppImage under firejail instead. The best solution is not to use AppImages at all — GUIX, Nix, pkgsrc & RavenPorts are all better alternatives IMO.

[PsySc0rpi0n]

Ok, thank you all.

I'm not going to enable any feature and expose my machine to attacks of any sorts, so I will follow @Head_on_a_Stick advice. Won't use AppImages at all.

Thanks
Psy

[sunrat]

Won't use AppImages at all.

Flatpaks and Snaps are worse from a wasted resources point of view, probably insecure as well especially from their download sites. I avoid all containerised packages generally but have 2 Appimages which have very specific usage and have used each one once. I'd never use Snap or Flatpak.
Appimages are the least bad containerised applications IMO.