Chromium fails to get data from google end point verification helper app

[Kristofer Tingdahl]

I am trying out Google end-point verification. This is a system that allows the admins of a Google Workplace env to set information security requirements on the browsers/systems that connect. When using snapped Chromium, it fails to fetch data from the host system.

The details:

Prelude
1. I use the latest Chromium from the snap-store (Version 116.0.5845.110 (Official Build) snap (64-bit))
2. I install the Google end-point verification extension: https://chrome.google.com/webstore/detail/endpoint-verification/callobklhcbilhphinckomhgkigmfocg
3. I install the helper app: https://support.google.com/a/users/answer/9018161?hl=en using apt.

What goes wrong
4. The helper app has a shell script that fetches the details of the host. That works fine. Note that it detects the encrypted disk.

kristofer@kristofer-ThinkPad-X1-Nano-Gen-1:~$ /opt/google/endpoint-verification/bin/device_state.sh
serial_number: "PW00QL5N"
disk_encrypted: ENABLED
os_version: "22.04"
screen_lock_secured: ENABLED
hostname: "kristofer-ThinkPad-X1-Nano-Gen-1"
model: "20UN002KMH"
os_firewall: "no"
mac_addresses: "00:d2:b1:d3:c4:42"
mac_addresses: "00:16:3e:00:00:00"
mac_addresses: "00:16:3e:4f:fa:02"
mac_addresses: "a6:8d:49:a8:08:fb"
mac_addresses: "04:56:e5:dc:20:fd"
kristofer@kristofer-ThinkPad-X1-Nano-Gen-1:~$

5. The chromium extension attempts to get this data, but fails. Here are the logs from the extension. Note that it has diskEncrypted set to false.
[230825 08:58:34.05] [ChromeDeviceInfoProvider] [WARNING] No policy set to fetch device certificate.
[230825 08:58:34.05] [ChromeDeviceInfoProvider] [WARNING] Error getting Device ID. Failed to retrieve the device id.
[230825 08:58:34.06] [ChromeDeviceInfoProvider] [DEBUG] Response: {"osVersion":"22","diskEncrypted":false,"screenLockSecured":true,"deviceSerialNumber":"","deviceModel":"20UN002KMH","deviceHostName":"kristofer-ThinkPad-X1-Nano-Gen-1","deviceMacAddresses":[]}.
[230825 08:58:34.06] [NativeDeviceInfoProvider] [WARNING] Error while fetching non-configurable device info. Specified native messaging host not found.

The same extension, on the same machine, running on Chrome is able to detect the data from (4):
[230825 09:00:49.97] [ChromeDeviceInfoProvider] [WARNING] No policy set to fetch device certificate.
[230825 09:00:49.98] [ChromeDeviceInfoProvider] [DEBUG] Response: {"osVersion":"22.04","diskEncrypted":true,"screenLockSecured":true,"deviceSerialNumber":"","deviceModel":"20UN002KMH","deviceHostName":"kristofer-ThinkPad-X1-Nano-Gen-1","deviceMacAddresses":["00:16:3e:4f:fa:02","00:16:3e:00:00:00","04:56:e5:dc:20:fd","a6:8d:49:a8:08:fb","00:d2:b1:d3:c4:42"],"deviceId":"QW2aBSoOVzwVDPNxJdhd1K5NtFs","osFirewall":false}.

I suspect, but I don't know, that the snap confinement prevents it from fetching the data. Should you have any questions or need help to get more detailed logs, please reach out to me.

[Nathan Teodosio (nteodosio)]

Hi Kristofer, thanks for the bug report.

You are most likely right that the confinement is the cause.

The source code of the extension is not available, is it?

[Kristofer Tingdahl (tingdahl)]

Hi Nathan, I expect that the source code of the extension is not available. Is there a way to boost verbosity of chromium (i.e. increase log-levels?) How would I be able to get the logs?

[Nathan Teodosio (nteodosio)]

Yes.

   >logfile 2>&1 snap run chromium --enable-logging

If that doesn't prove sufficient you can also add --v=1.

Having journalctl -f running at the same time will allow you to see
Apparmor denials.