Bubblewrap and linux-hardened kernel

[outer sun]

I have been having problems on Arch with the hardened kernel and bubblewrap.

I created a post a while back and the solution was to install bubblewrap-suid, which I did. But when I install and attempt to run some applications that (I believe) require something called chrome-sandbox, I get an error like this:

[123456:1234/123456.123456:FATAL:setuid_sandbox_host.cc(157)] The SUID sandbox helper binary was found, but is not configured correctly. Rather than run without sandboxing I'm aborting now. You need to make sure that /something/chrome-sandbox is owned by root and has mode 4755.

"something" is usually /tmp/ or /opt/. I was able to successfully workaround this by doing as instructed for some apps, but other apps (where the file is in /tmp/), there is no file in the specified location to set the necessary permissions. In any case, this would be a workaround. How do I fix this problem?

Here is my last issue: https://discord.com/channels/399812551963049995/1127571333702762547

[blazing dragon]

This error message is from chromium https://github.com/chromium/chromium/blob/30f1c3bb346b39e90849ea6663801dad900f1b8a/sandbox/linux/suid/client/setuid_sandbox_host.cc#L156

[outer sun]

okay...

[blazing dragon]

Or programm that use Chromium code, such as electron

[blazing dragon]

You can either run them with --no-sandbox (probably not a good idea),
or

sudo chown root chrome-sandbox
sudo chmod 4755 chrome-sandbox

or

sysctl kernel.unprivileged_userns_clone=1

[outer sun]

I did this

the second thing, I did, but someone said it's not recommended for security reasons

their advice was to install bubblewrap-suid, which I did, but I get the above errors (for some things)

[blazing dragon]

If security is a concern, unrestricted use of namespaces is not recommended either, as it significantly increases the attack surface.

https://bugs.archlinux.org/task/36969

[outer sun]

okay so what is the solution

I am using hardened kernel and bubblewrap, two things that increase security

but any solution reduces the security

so what do I do? is there a way to fix this without the workarounds, while maintaining security? or do I have to uninstall the kernel (properly of course)

[blazing dragon]

The sysctl kernel.unprivileged_userns_clone defeats the purpose of using the Linux hardened kernel.

[outer sun]

i see

so that option is out

--no-sandbox obviously makes that specific app run without a sandbox, which is better but not ideal

[blazing dragon]

--no-sandbox is probably the only workaround for now.

[outer sun]

what about chmod u+s /usr/bin/bwrap

[blazing dragon]

Aren't you already using bubblewrap-suid?

The reason for using suid with bubblewrap is to avoid unprivileged_userns_clone.

Chromium code uses its own sandbox, which normally uses the unprivileged user namespace.

[outer sun]

yes

[outer sun]

oh

so unprivileged_userns_clone is system-wide, tldr it disables the hardened kernel security protections

chmod u+s /usr/bin/bwrap makes bubblewrap run as suid?

but installing bubblewrap-suid does the same thing?

[blazing dragon]

That command set setuid bit

[outer sun]

not sure what that means

i apologize, I know I am missing a lot of computer science here

[blazing dragon]

Bubblewrap without setuid won't work on a hardened kernel. https://bugs.archlinux.org/task/63316
Sacrifices must be made and you must use setuid,

[outer sun]

okay

thank you

are there any other possibilities here

keeping the hardened kernel, and bubblewrap

In the future I want to develop a hardened arch installation

eventually I'm gonna want to get into the weeds, and this seems like a major flaw

[blazing dragon]

You have been told no sereral time. It is not possible without sacrifices, either setuid bit or unprivileged namespace is required, there is no middle ground now.

[outer sun]

ah, alright

Thanks anyway.

[blazing dragon]

The setuid privilege or bit allows a file to temporarily grant the executing user the privileges of the file's owner.

This alllows the executing user to access the privileges and resource of owner of executable.

It is safe as long as the program with setuid is robust

e.g. sudo has the setuid bit set to allow you to become root or someone else

[outer sun]

okay

thanks, I will revisit this another day because eventually I'm gonna run into this problem again and I'm gonna want to find a way. Whether it's tweaking the kernel, or installing a different sandboxing framework...I don't know.

@blazing dragonwait, what if you ran the program in a different sandbox, one that doesn't use suid?

firejail?

or maybe tweak apparmor?

I don't know enough about these tools to really know how to mitigate this problem.

[blazing dragon]

This is a negative, all these sandboxes use either setuid or the unprivileged user namespace.

[blazing dragon]

apparmor is not the same as sandboxing

[outer sun]

yes, though I'm sure it acts to restrict what a program can do

[blazing dragon]

You can migrate it with setuid

[outer sun]

and if a program is not sandboxed then apparmor should be able to help

[outer sun]

But the --no-sandbox argument bypasses the sandbox, doesn't it?

meaning no sandbox protections

[blazing dragon]

Chromium uses its own sandbox, which normally uses the unprivileged user namespace.

[blazing dragon]

Isn't that obvious?

[outer sun]

yeah, but you did say "you can mitig...oh, you said migrate

I thought you said mitigate

[blazing dragon]

a typo, I said you can mitigate it with setuid.

[outer sun]

okay but no sandbox is not a mitigation

[blazing dragon]

sudo chown root chrome-sandbox
sudo chmod 4755 chrome-sandbox

[outer sun]

no sandbox is 0, no protection

[outer sun]

what's this

recommended steps?

[blazing dragon]

If you read this thread earlier, I did not say no sandbox when I said setuid.

Sorry for the confusion

[outer sun]

I apologize but I don't understand.

It's not your fault. I just haven't done a whole lot of research on suid or setuid or namespaces or anything of this.

I'm still learning linux, despite using it for 4 years

[blazing dragon]

setuid is required for Sandbox to work on hardened kernel

[outer sun]

okay..

I'm afraid I'm just gonna bug you with more questions because although you say x is required for x to work on x...I don't know what x is.

so feel free to not answer any more of my questions if you don't want to

[blazing dragon]

If you don't understand these concepts yet, why not just use the regular kernel for now and understand them later in an environment more conducive to learning by trial and error, such as a virtual machine?

[outer sun]

that is a good method, though, I already have.

[blazing dragon]

Please feel free to ask

[outer sun]

I've tested the hardened kernel already, with arch, with apparmor, firejail too

I did this maybe a year ago

been using arch since nov 2022

done plenty of research but always more to learn

Eventually I want to learn arch in depth. I want to learn to harden it.

I'm gonna install Qubes soon (not my first time), keep arch on a VM to test with

it does seem that experimenting on bare metal, especially my main system, probably not a good idea

[blazing dragon]

Qubes
This is a rabbit hole

[outer sun]

I would ask what setuid means, and what you mean when you say "sandbox" (are you referring to bubblewrap itself, or the framework that bubblewrap uses), but I feel like I could google these things.

[outer sun]

I've gone down that rabbithole myself a few times

[blazing dragon]

Previously answered

[blazing dragon]

see this

[outer sun]

what is "setuid privilege" and "bit"?

firstly, what does setuid stand for

Does uid refer to PID? for example, user runs on 1000

[blazing dragon]

The setuid privilege or bit allows a file to temporarily grant the executing user the privileges of the file's owner.
This alllows the executing user to access the privileges and resource of owner of executable.
It is safe as long as the program with setuid is robust
e.g. sudo has the setuid bit set to allow you to become root or someone else

It sands for temporarily grant the executing user the privileges of the file's owner

[outer sun]

even if the owner is root?

[blazing dragon]

short for set user identity

[blazing dragon]

.Why don't you read the Wikipedia article about it? It's comprehensive and should answer most of your questions.

https://en.wikipedia.org/wiki/Setuid

[outer sun]

well that's what I meant about bugging you with questions, I could google all of this. But that would be a lot of research.

I can't devote enough time to read about setuid and relevant stuff

just needed to fix a problem, now that I know --no-sandbox is the solution I'll go with that

[blazing dragon]

Asking me is almost like doing your own research.

[outer sun]

some would argue with that, people just say RTFM

[blazing dragon]

because you might get confused by some concepts or terms and start to asking about them too.

[outer sun]

why do I get the feeling you're a bot that knows everything

[blazing dragon]

I don't think it's any different from reading wikis.

[outer sun]

yes, I agree

[blazing dragon]

Ha, Nein. Ich bin kein Bot, ich bin ganz Mensch

[outer sun]

at the moment, I don't even know enough to ask any relevant questions about this topic

[outer sun]

hey, I'm learning german

[blazing dragon]

Moreover, Wiki is written by many (experienced) people. It would certainly be more reliable than me.

[outer sun]

God you sound so much like a bot

[blazing dragon]

There is also a talk page on the Arch wiki, so if you don't understand something, just ask the author. We will answer if time allows.

[outer sun]

you're either a bot or you use some stylometry tool like https://github.com/spencermwoo/anonymouth

[outer sun]

alright, thanks

[dapper cave]

memchr received a thank you cookie!

[outer sun]

gonna head off now.

member of the openAI server...hm