Dockerized chrome sandbox problem about dockerfiles

[mpe]

It's not /dev/dri that's the problem, it's that chrome can't create a new name space for the sandbox:

Failed to move to new namespace: PID namespaces supported, Network namespace supported, but failed: errno = Operation not permitted

You can fix that by using --cap-add=CAP_SYS_ADMIN.

eg:

$ docker run --cap-add=SYS_ADMIN -e DISPLAY --net=host -u michael -it mpee/chrome chromium-browser
/usr/bin/chromium-browser: line 77: lsmod: command not found

(chromium-browser:1): GLib-GIO-CRITICAL **: g_settings_schema_source_lookup: assertion 'source != NULL' failed
libGL error: failed to open drm device: No such file or directory
libGL error: failed to load driver: i965
ATTENTION: default value of option force_s3tc_enable overridden by environment.
[37:37:0506/053009:ERROR:sandbox_linux.cc(325)] InitializeSandbox() called with multiple threads in process gpu-process

Notice it still can't open the DRI device (libGL errors), but it's not complaining about the sandbox. Not sure what the last sandbox error is.

[jessfraz]

It's just a warning it works regardless they are even depreciatinng the suid sandbox in favor of the one w userns

On Sunday, April 26, 2015, brunetto [email protected] wrote:

It seems chrome is not able to run with sandbox. It suggests to recompile
with that option.

[1:1:0426/110158:ERROR:browser_main_loop.cc(171)] Running without the SUID sandbox! See https://code.google.com/p/chromium/wiki/LinuxSUIDSandboxDevelopment for more information on developing with the sandbox on.

May be is there another workaround?

—
Reply to this email directly or view it on GitHub
#17.

Jessie Frazelle
4096R / D4C4 DD60 0D66 F65A 8EFC 511E 18F3 685C 0022 BFF3
pgp.mit.edu http://pgp.mit.edu/pks/lookup?op=get&search=0x18F3685C0022BFF3

[mpe]

Actually it's saying that it's running without the sandbox enabled. What that means is that the renderer (ie. the process that draws web pages), is running with more permissions than it usually would. That means a bug in the renderer is more likely to lead to your kernel being exploited than if you are running with the sandbox enabled.

[jessfraz]

the old setuid sandbox is the one that doesnt work the new namespace sandbox is the one that does because it uses userns

[jessfraz]

Ya but if you don't want it to kill pages every 2 minutes with the sandbox,
then you gotta have /dev/dri also I don't run privileged or add
CAP_SYSADMIN, I've never seen the namespace error

looks like you might not have the ability to clone_newuser

On Tuesday, May 5, 2015, Michael Ellerman [email protected] wrote:

It's not /dev/dri that's the problem, it's that chrome can't create a new
name space for the sandbox:

Failed to move to new namespace: PID namespaces supported, Network namespace supported, but failed: errno = Operation not permitted

You can fix that by using --cap-add=CAP_SYS_ADMIN.

eg:

$ docker run --cap-add=SYS_ADMIN -e DISPLAY --net=host -u michael -it mpee/chrome chromium-browser
/usr/bin/chromium-browser: line 77: lsmod: command not found

(chromium-browser:1): GLib-GIO-CRITICAL **: g_settings_schema_source_lookup: assertion 'source != NULL' failed
libGL error: failed to open drm device: No such file or directory
libGL error: failed to load driver: i965
ATTENTION: default value of option force_s3tc_enable overridden by environment.
[37:37:0506/053009:ERROR:sandbox_linux.cc(325)] InitializeSandbox() called with multiple threads in process gpu-process

Notice it still can't open the DRI device (libGL errors), but it's not
complaining about the sandbox. Not sure what the last sandbox error is.

—
Reply to this email directly or view it on GitHub
#17 (comment)
.

Jessie Frazelle
4096R / D4C4 DD60 0D66 F65A 8EFC 511E 18F3 685C 0022 BFF3
pgp.mit.edu http://pgp.mit.edu/pks/lookup?op=get&search=0x18F3685C0022BFF3

[jessfraz]

My current file works for me without the --no-sandbox flag and with
--device /dev/dri

On Tuesday, May 5, 2015, Jessica Frazelle [email protected] wrote:

Ya but if you don't want it to kill pages every 2 minutes with the
sandbox, then you gotta have /dev/dri also I don't run privileged or add
CAP_SYSADMIN, I've never seen the namespace error

On Tuesday, May 5, 2015, Michael Ellerman <[email protected]
javascript:_e(%7B%7D,'cvml','[email protected]');> wrote:

It's not /dev/dri that's the problem, it's that chrome can't create a
new name space for the sandbox:

Failed to move to new namespace: PID namespaces supported, Network namespace supported, but failed: errno = Operation not permitted

You can fix that by using --cap-add=CAP_SYS_ADMIN.

eg:

$ docker run --cap-add=SYS_ADMIN -e DISPLAY --net=host -u michael -it mpee/chrome chromium-browser
/usr/bin/chromium-browser: line 77: lsmod: command not found

(chromium-browser:1): GLib-GIO-CRITICAL **: g_settings_schema_source_lookup: assertion 'source != NULL' failed
libGL error: failed to open drm device: No such file or directory
libGL error: failed to load driver: i965
ATTENTION: default value of option force_s3tc_enable overridden by environment.
[37:37:0506/053009:ERROR:sandbox_linux.cc(325)] InitializeSandbox() called with multiple threads in process gpu-process

Notice it still can't open the DRI device (libGL errors), but it's not
complaining about the sandbox. Not sure what the last sandbox error is.

—
Reply to this email directly or view it on GitHub
#17 (comment)
.

Jessie Frazelle
4096R / D4C4 DD60 0D66 F65A 8EFC 511E 18F3 685C 0022 BFF3
pgp.mit.edu
http://pgp.mit.edu/pks/lookup?op=get&search=0x18F3685C0022BFF3

Jessie Frazelle
4096R / D4C4 DD60 0D66 F65A 8EFC 511E 18F3 685C 0022 BFF3
pgp.mit.edu http://pgp.mit.edu/pks/lookup?op=get&search=0x18F3685C0022BFF3

[mpe]

OK, I'm using chromium and starting with ubuntu:15.04 so that might explain the differences. I would not recommend anyone run with --no-sandbox.