Linux SUID sandbox doesn't work in Brave

[morfikov]

I noticed that when the brave-keyring debian package is installed, it manipulates the kernel.unprivileged_userns_clone setting, and the option is set to 1 . Why do you do this? All the other browsers (chromium, google-chrome, opera) work fine with kernel.unprivileged_userns_clone set to0 . In such case, the browses simply execute the *-sandbox binary. But in the case of brave, when the option kernel.unprivileged_userns_clone is set to 0 I get the following error:

$ brave-browser
[981631:981631:1001/124303.671622:FATAL:zygote_host_impl_linux.cc(116)] No usable sandbox! You probably need to enable user namespaces in your kernel. See https://brave-browser.readthedocs.io/en/latest/installing-brave.html#linux for more information.
[1]    981631 trace trap  brave-browser

I also noticed that the /opt/brave.com/brave/brave-sandbox binary isn't executed at all. The strace said that /opt/brave.com/brave/chrome-sandbox not found. I created a link to brave-sandbox and called it chrome-sandbox

# ls -al /opt/brave.com/brave | grep sandbox
-rwsr-xr-x 1 root root    227928 2019-09-27 19:31:57 brave-sandbox*
lrwxrwxrwx 1 root root        13 2019-10-01 12:46:35 chrome-sandbox -> brave-sandbox*

Now when I start brave-browser it works and executes its sandbox like the other browsers executes theirs:

# ps aux | grep sandbox
morfik    984752  0.0  0.0   2724  1872 pts/13   S+   12:47   0:00 /opt/brave.com/brave/chrome-sandbox /opt/brave.com/brave/brave --type=zygote
...

So what do you think about creating this little chrome-sandbox link? In this way the brave browser would support both of the values (0/1) in the kernel.unprivileged_userns_clone option, and you wouldn't have to manipulate with sysctl kernel parameters, which isn't really a good thing.

[kjozwiak]

CCing @fmarier.

[fmarier]

You're right, that was added in #5502 in order to make Brave work in the default Debian configuration (while user namespaces are enabled by default in Ubuntu, they're not in Debian). The reason why we require user namespaces is that the chrome sandbox is deprecated: #1986 (comment)

Thanks for pointing out that renaming/symlinking the sandbox binary makes it work. Based on what we've heard from Chromium developers however, this is not likely to work in the long run as user namespaces is the only mechanism that's supported upstream.

[btlechowski]

Verification passed on

Brave	1.2.40 Chromium: 79.0.3945.88 (Official Build) (64-bit)
Revision	c2a58a36b9411c80829b4b154bfcab97e581f1f3-refs/branch-heads/3945@{#954}
OS	Ubuntu 18.04 LTS

Verified test plan from brave/brave-core#4223