2

We are using Chrome/Chromium headless for screen grabbing.

(Out of the sudden) Chrome refuses to start.

strace reveals this error:

The setuid sandbox is not running as root. Common causes:
  * An unprivileged process using ptrace on it, like a debugger.
  * A parent process set prctl(PR_SET_NO_NEW_PRIVS, ...)
Failed to move to new namespace: PID namespaces supported, Network namespace supported, but failed: errno = Operation not permitted
Failed to generate minidump.Illegal instruction

The error is the same for Google Chrome (unstable) and Chromium.

The file permissions for the chrome-sandbox binary are they should (setid root):

grabber@mail:/opt/google/chrome$ ./google-chrome --version
Google Chrome 76.0.3809.87

grabber@mail:/opt/google/chrome$ ls -la *sandbox*
-rwsr-xr-x 1 root root 227856 Jul 28 10:19 chrome-sandbox

The OS release is VERSION="16.04.6 LTS (Xenial Xerus).

The workaround is likely to use --no-sandbox but I wonder what else might cause (the sudden) problem?

Running google-chrome as root:

[32718:32718:0807/061610.314297:ERROR:zygote_host_impl_linux.cc(89)] Running as root without --no-sandbox is not supported. See https://crbug.com/638180.

root@mail:~# /opt/google/chrome/google-chrome  --no-sandbox
root@mail:~# [0807/061615.230679:ERROR:nacl_helper_linux.cc(310)] NaCl helper process running without a sandbox!
Most likely you need to configure your SUID sandbox correctly
5
  • What is the hardware? Aug 6, 2019 at 17:51
  • That's VM (64bit)..has worked for years...
    – jens2
    Aug 6, 2019 at 17:57
  • What's the behaviour when you don't run it under strace (or at least run it under strace as root)?
    – womble
    Aug 6, 2019 at 22:59
  • Updated for clarifcation
    – jens2
    Aug 7, 2019 at 4:17
  • Anything in /var/log about AppArmor maybe? StrongSwan has problems opening sockets when using swanctl because of poor AppArmor configuration so it's not unheard of. Aug 10, 2019 at 21:10

0

You must log in to answer this question.

Browse other questions tagged .