[Bug 2046844] Re: AppArmor user namespace creation restrictions cause many applications to crash with SIGTRAP

[Ondra Medek]

@jjohansen @georgiag Thanks for the replies and hints. I didn't have
apparmor profile and that fixes the problem. (I have created feature
request for electron-builder https://github.com/electron-
userland/electron-builder/issues/8635)

Without apparmor profile, an Electron.js app complains: The SUID sandbox
helper binary was found, but is not configured correctly. Rather than
run without sandboxing I'm aborting now. You need to make sure that
/opt/Custom App/chrome-sandbox is owned by root and has mode 4755.

So I set SUID as suggested: sudo chmod 4755 "/opt/Custom App/chrome-
sandbox"

And now, if the path is without space (e.g. /opt/CustomApp), then the
Electron app works. When it has a space, it fails with "LaunchProcess:
failed to execvp" I have mentioned above. syslog contains logs (stripped
prefixes):

kernel: audit: type=1400 audit(1729968745.234:136): apparmor="AUDIT" operation="userns_create" class="namespace" info="Userns create - transitioning profile" profile="unconfined" pid=2196 comm="custom-app" requested="userns_create" target="unprivileged_userns"
kernel: audit: type=1400 audit(1729968745.236:137): apparmor="DENIED" operation="capable" class="cap" profile="unprivileged_userns" pid=2198 comm="custom-app" capability=21  capname="sys_admin"
kernel: traps: custom-app[2196] trap int3 ip:57e938a5c46c sp:7fff1815e5a0 error:0 in custom-app[57e934ad0000+8972000]

So, when I do: mv "/opt/Custom App" "/opt/CustomApp"
It starts working. (And I do not have any apparmor profile for "/opt/CustomApp"). In syslog, I have just the first message: apparmor="AUDIT"

It's possible error message is from Electron.js code.

** Bug watch added: github.com/electron-userland/electron-builder/issues #8635
   https://github.com/electron-userland/electron-builder/issues/8635

-- 
You received this bug notification because you are a member of Mozilla
Bugs, which is subscribed to firefox in Ubuntu.
https://bugs.launchpad.net/bugs/2046844

Title:
  AppArmor user namespace creation restrictions cause many applications
  to crash with SIGTRAP

To manage notifications about this bug go to:
https://bugs.launchpad.net/apparmor/+bug/2046844/+subscriptions