chromium needs to be able to execute its own sandbox binary to function

[Nick Moffitt]

[1535661.818433] type=1400 audit(1390900754.319:5783451): apparmor="DENIED" operation="exec" parent=7938 profile="/usr/lib/chromium-browser/chromium-browser" name="/usr/lib/chromium-browser/chrome-sandbox" pid=22049 comm="chromium-browse" requested_mask="x" denied_mask="x" fsuid=1000 ouid=0

When /usr/bin/chromium-browser is in enforce mode in saucy (and presumably trusty still has this problem), it is unable to launch its own sandbox executable. This makes things like opening new tabs and going into incognito mode impossible.

ProblemType: Bug
DistroRelease: Ubuntu 13.10
Package: apparmor-profiles 2.8.0-0ubuntu31.1
ProcVersionSignature: Ubuntu 3.11.0-15.23-generic 3.11.10
Uname: Linux 3.11.0-15-generic x86_64
ApportVersion: 2.12.5-0ubuntu2.2
Architecture: amd64
Date: Tue Jan 28 09:32:02 2014
EcryptfsInUse: Yes
MarkForUpload: True
PackageArchitecture: all
ProcKernelCmdline: root=UUID=5237fceb-23d0-412d-84d9-b8f8b3bf28af ro quiet splash
SourcePackage: apparmor
Syslog:

UpgradeStatus: Upgraded to saucy on 2013-09-17 (132 days ago)
modified.conffile..etc.apparmor.d.usr.bin.chromium.browser: [modified]
mtime.conffile..etc.apparmor.d.usr.bin.chromium.browser: 2014-01-28T09:20:40.838649

[Nick Moffitt (nick-moffitt)]

I found this in the profile:

  # Allow transitions to ourself and our sandbox
  /usr/lib/chromium-browser/chromium-browser ix,
  /usr/lib/chromium-browser/chromium-browser-sandbox cx -> chromium_browser_sandbox,

This seems to have become insufficient somehow. In the chromium_browser_sandbox profile:

    /usr/lib/chromium-browser/chromium-browser-sandbox r,

So is it just that a sandbox process can't start another one?

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Foivos Zakkak (foivos)]

It looks like the sandbox is called chrome-sandbox and not chromium-browser-sandbox anymore

[Foivos Zakkak (foivos)]

Please try this patch and let me know.

[Ubuntu Foundations Team Bug Bot (crichton)]

The attachment "usr.bin.chromium-browser.patch" seems to be a patch. If it isn't, please remove the "patch" flag from the attachment, remove the "patch" tag, and if you are a member of the ~ubuntu-reviewers, unsubscribe the team.

[This is an automated message performed by a Launchpad user owned by ~brian-murray, for any issues please contact him.]