The error message reads: [1:1:0320/100303:FATAL:setuid_sandbox_client.cc(126)] Check failed: IsFileSystemAccessDenied(). Reproducible: Always OberonGentoo ~ # emerge --info Portage 2.2.18 (python 3.4.3-final-0, default/linux/amd64/13.0/no-multilib, gcc-4.9.2, glibc-2.20-r2, 3.19.2-gentoo-APT-2015 x86_64) ================================================================= System uname: Linux-3.19.2-gentoo-APT-2015-x86_64-Intel-R-_Core-TM-_i5-4570_CPU_@_3.20GHz-with-gentoo-2.2 KiB Mem: 8098108 total, 7226756 free KiB Swap: 2097148 total, 2097148 free Timestamp of repository gentoo: Fri, 20 Mar 2015 06:30:01 +0000 sh bash 4.3_p33-r2 ld GNU ld (Gentoo 2.25 p1.0) 2.25 app-shells/bash: 4.3_p33-r2::gentoo dev-java/java-config: 2.2.0::gentoo dev-lang/perl: 5.20.2::gentoo dev-lang/python: 2.7.9-r2::gentoo, 3.3.5-r1::gentoo, 3.4.3::gentoo dev-util/cmake: 3.1.0::gentoo dev-util/pkgconfig: 0.28-r2::gentoo sys-apps/baselayout: 2.2::gentoo sys-apps/openrc: 0.13.11::gentoo sys-apps/sandbox: 2.6-r1::gentoo sys-devel/autoconf: 2.69-r1::gentoo sys-devel/automake: 1.14.1::gentoo, 1.15::gentoo sys-devel/binutils: 2.25::gentoo sys-devel/gcc: 4.9.2::gentoo sys-devel/gcc-config: 1.8::gentoo sys-devel/libtool: 2.4.6-r1::gentoo sys-devel/make: 4.1-r1::gentoo sys-kernel/linux-headers: 3.19::gentoo (virtual/os-headers) sys-libs/glibc: 2.20-r2::gentoo Repositories: gentoo location: /usr/portage sync-type: rsync sync-uri: rsync://rsync.gentoo.org/gentoo-portage priority: -1000 ACCEPT_KEYWORDS="amd64 ~amd64" ACCEPT_LICENSE="*" CBUILD="x86_64-pc-linux-gnu" CFLAGS="-march=native -O2 -pipe" CHOST="x86_64-pc-linux-gnu" CONFIG_PROTECT="/etc /usr/share/config /usr/share/gnupg/qualified.txt" CONFIG_PROTECT_MASK="/etc/ca-certificates.conf /etc/dconf /etc/env.d /etc/fonts/fonts.conf /etc/gconf /etc/gentoo-release /etc/revdep-rebuild /etc/sandbox.d /etc/terminfo" CXXFLAGS="-march=native -O2 -pipe" DISTDIR="/usr/portage/distfiles" FCFLAGS="-O2 -pipe" FEATURES="assume-digests binpkg-logs config-protect-if-modified distlocks ebuild-locks fixlafiles merge-sync news parallel-fetch preserve-libs protect-owned sandbox sfperms strict unknown-features-warn unmerge-logs unmerge-orphans userfetch userpriv usersandbox usersync" FFLAGS="-O2 -pipe" GENTOO_MIRRORS="http://mirror.leaseweb.com/gentoo/ http://mirror.netcologne.de/gentoo/ http://ftp.snt.utwente.nl/pub/os/linux/gentoo http://linux.rz.ruhr-uni-bochum.de/download/gentoo-mirror/" LANG="en_US.utf8" LDFLAGS="-Wl,-O1 -Wl,--as-needed" MAKEOPTS="-j5" PKGDIR="/usr/portage/packages" PORTAGE_CONFIGROOT="/" PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --omit-dir-times --compress --force --whole-file --delete --stats --human-readable --timeout=180 --exclude=/distfiles --exclude=/local --exclude=/packages" PORTAGE_TMPDIR="/var/tmp" USE="X acl acpi alsa amd64 berkdb bzip2 cli consolekit cracklib crypt cxx dbus dri exif fat fortran gdbm glamor gstreamer iconv icu ipv6 java jpeg jpeg2k kde libav mmx modules ncurses nls nptl opengl openmp pam pcre png policykit python qt3support qt4 readline session sse sse2 ssl tcpd tiff truetype udev udisks unicode zlib" ABI_X86="64" ALSA_CARDS="hda-intel" APACHE2_MODULES="authn_core authz_core socache_shmcb unixd actions alias auth_basic authn_alias authn_anon authn_dbm authn_default authn_file authz_dbm authz_default authz_groupfile authz_host authz_owner authz_user autoindex cache cgi cgid dav dav_fs dav_lock deflate dir disk_cache env expires ext_filter file_cache filter headers include info log_config logio mem_cache mime mime_magic negotiation rewrite setenvif speling status unique_id userdir usertrack vhost_alias" CALLIGRA_FEATURES="kexi words flow plan sheets stage tables krita karbon braindump author" CAMERAS="ptp2" COLLECTD_PLUGINS="df interface irq load memory rrdtool swap syslog" CPU_FLAGS_X86="aes avx avx2 fma3 mmx mmxext popcnt sse sse2 sse3 sse4_1 sse4_2 ssse3" ELIBC="glibc" GPSD_PROTOCOLS="ashtech aivdm earthmate evermore fv18 garmin garmintxt gpsclock itrax mtk3301 nmea ntrip navcom oceanserver oldstyle oncore rtcm104v2 rtcm104v3 sirf superstar2 timing tsip tripmate tnt ublox ubx" GRUB_PLATFORMS="pc efi-64" INPUT_DEVICES="evdev" KERNEL="linux" LCD_DEVICES="bayrad cfontz cfontz633 glk hd44780 lb216 lcdm001 mtxorb ncurses text" LIBREOFFICE_EXTENSIONS="presenter-console presenter-minimizer" LINGUAS="nl en" OFFICE_IMPLEMENTATION="libreoffice" PHP_TARGETS="php5-5" PYTHON_SINGLE_TARGET="python2_7" PYTHON_TARGETS="python2_7 python3_3 python3_4" RUBY_TARGETS="ruby19 ruby20" USERLAND="GNU" VIDEO_CARDS="intel i965 radeon radeonsi" XTABLES_ADDONS="quota2 psd pknock lscan length2 ipv4options ipset ipp2p iface geoip fuzzy condition tee tarpit sysrq steal rawnat logmark ipmark dhcpmac delude chaos account" USE_PYTHON="2.7 3.3 3.4" Unset: CPPFLAGS, CTARGET, EMERGE_DEFAULT_OPTS, INSTALL_MASK, LC_ALL, PORTAGE_BUNZIP2_COMMAND, PORTAGE_COMPRESS, PORTAGE_COMPRESS_FLAGS, PORTAGE_RSYNC_EXTRA_OPTS
how exactly are you starting chrome ? can you post the full output log please
(In reply to SpanKY from comment #1) > how exactly are you starting chrome ? can you post the full output log > please Thx for quick reply. Unfortunately on this system I also decided to move to KDE Plasma 5. I have trouble in achieving this and posted a few bugs. In the meantime, it is hard for me to reproduce the bug since I am left without a working KDE version. I will come back to this ASAP.
Having same problem. ------ localhost / # chromium [1:1:0326/213629:FATAL:setuid_sandbox_client.cc(126)] Check failed: IsFileSystemAccessDenied(). ^C localhost / # dmesq: [46425.427650] traps: chrome[3241] general protection ip:7f18c96d72a6 sp:7fffc074c660 error:0 in libc-2.20.so[7f18c96a1000+18e000] Its start from chromium-42.0.2311.50.ebuild
Confirm this bug, same behavior here. Updated yesterday, Gnome3 box. When started using taskbar icon, nothing happens, but both chrome and sandbox processes show up on system monitor. When started from a terminal: #chromium-browser [1:1:0327/024617:FATAL:setuid_sandbox_client.cc(126)] Check failed: IsFileSystemAccessDenied(). #dmesg traps: chrome[6476] general protection ip:7f1ef49b1276 sp:7fff2bacd2a0 error:0 in libc-2.20.so[7f1ef497b000+18e000] gentoo-i7 ~ # emerge --info Portage 2.2.18 (python 2.7.9-final-0, default/linux/amd64/13.0/desktop/gnome/systemd, gcc-4.8.3, glibc-2.20-r2, 3.10.17-gentoo x86_64) ================================================================= System uname: Linux-3.10.17-gentoo-x86_64-Intel-R-_Core-TM-_i7-2600K_CPU_@_3.40GHz-with-gentoo-2.2 KiB Mem: 16412588 total, 14075612 free KiB Swap: 1889168 total, 1889168 free Timestamp of repository gentoo: Thu, 26 Mar 2015 19:00:01 +0000 sh bash 4.3_p33-r2 ld GNU ld (Gentoo 2.25 p1.0) 2.25 app-shells/bash: 4.3_p33-r2::gentoo dev-java/java-config: 2.2.0::gentoo dev-lang/perl: 5.20.2::gentoo dev-lang/python: 2.7.9-r2::gentoo, 3.3.5-r1::gentoo, 3.4.3::gentoo dev-util/cmake: 3.1.0::gentoo dev-util/pkgconfig: 0.28-r2::gentoo sys-apps/baselayout: 2.2::gentoo sys-apps/openrc: 0.13.11::gentoo sys-apps/sandbox: 2.6-r1::gentoo sys-devel/autoconf: 2.13::gentoo, 2.69-r1::gentoo sys-devel/automake: 1.11.6-r1::gentoo, 1.12.6::gentoo, 1.13.4::gentoo, 1.14.1::gentoo, 1.15::gentoo sys-devel/binutils: 2.25::gentoo sys-devel/gcc: 4.7.3-r1::gentoo, 4.8.3::gentoo, 4.9.2::gentoo sys-devel/gcc-config: 1.8::gentoo sys-devel/libtool: 2.4.6-r1::gentoo sys-devel/make: 4.1-r1::gentoo sys-kernel/linux-headers: 3.19::gentoo (virtual/os-headers) sys-libs/glibc: 2.20-r2::gentoo Repositories: gentoo location: /usr/portage sync-type: rsync sync-uri: rsync://rsync.gentoo.org/gentoo-portage priority: -1000 multimedia location: /var/lib/layman/multimedia masters: gentoo priority: 50 ACCEPT_KEYWORDS="amd64 ~amd64" ACCEPT_LICENSE="*" CBUILD="x86_64-pc-linux-gnu" CFLAGS="-march=native -O2 -pipe" CHOST="x86_64-pc-linux-gnu" CONFIG_PROTECT="/etc /usr/share/config /usr/share/gnupg/qualified.txt /var/lib/hsqldb" CONFIG_PROTECT_MASK="/etc/ca-certificates.conf /etc/dconf /etc/env.d /etc/fonts/fonts.conf /etc/gconf /etc/gentoo-release /etc/revdep-rebuild /etc/sandbox.d /etc/terminfo" CXXFLAGS="-march=native -O2 -pipe" DISTDIR="/usr/portage/distfiles" FCFLAGS="-O2 -pipe" FEATURES="assume-digests binpkg-logs config-protect-if-modified distlocks ebuild-locks fixlafiles merge-sync news parallel-fetch preserve-libs protect-owned sandbox sfperms strict unknown-features-warn unmerge-logs unmerge-orphans userfetch userpriv usersandbox usersync" FFLAGS="-O2 -pipe" GENTOO_MIRRORS="http://gentoo.mirrors.easynews.com/linux/gentoo/ http://gentoo.mirrors.hoobly.com/ ftp://ftp.ucsb.edu/pub/mirrors/linux/gentoo/" LDFLAGS="-Wl,-O1 -Wl,--as-needed" MAKEOPTS="-j9 -l14" PKGDIR="/usr/portage/packages" PORTAGE_CONFIGROOT="/" PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --omit-dir-times --compress --force --whole-file --delete --stats --human-readable --timeout=180 --exclude=/distfiles --exclude=/local --exclude=/packages" PORTAGE_TMPDIR="/var/tmp" USE="X a52 aac acl acpi ads alsa amd64 berkdb bluetooth bluray branding bzip2 cairo cdda cddb cdparanoia cdr cli colord cracklib crypt cups cxx dbus device-mapper dri dts dv dvd dvdnav dvdr dvdread eds embedded emboss encode evo exif extras fam ffmpeg firefox flac foomaticdb fortran ftp gd gdbm gdu gif git glamor gnome gnome-keyring gnome-online-accounts gnutls gphoto2 gpm gstreamer gtk gtk2 gtk3 hal iconv icu id3tag imagemagick introspection ipo ipv6 java javascript jpeg lame lcms ldap libnotify libsecret lzma lzo mad matroska minizip mjpeg mmx mmxext mng modules mozilla mp3 mp4 mpeg mplayer multilib mysql nautilus ncurses network nls nptl nptlonly nsplugin nvidia ogg opengl openmp pam pango pcre pdf php plasma png policykit postproc ppds pulseaudio python qt3support qt4 quicktime readline sdl seamonkey semantic-desktop session socialweb soprano spell sql sse sse2 sse3 ssl startup-notification subversion svg systemd tcpd theora threads tiff truetype udev udisks unicode upower usb vorbis webkit win32codecs winbind wxwidgets x264 xcb xine xml xscreensaver xulrunner xv xvid zlib" ABI_X86="32 64" ALSA_CARDS="ali5451 als4000 atiixp atiixp-modem bt87x ca0106 cmipci emu10k1x ens1370 ens1371 es1938 es1968 fm801 hda-intel intel8x0 intel8x0m maestro3 trident usb-audio via82xx via82xx-modem ymfpci" APACHE2_MODULES="authn_core authz_core socache_shmcb unixd actions alias auth_basic authn_alias authn_anon authn_dbm authn_default authn_file authz_dbm authz_default authz_groupfile authz_host authz_owner authz_user autoindex cache cgi cgid dav dav_fs dav_lock deflate dir disk_cache env expires ext_filter file_cache filter headers include info log_config logio mem_cache mime mime_magic negotiation rewrite setenvif speling status unique_id userdir usertrack vhost_alias" CALLIGRA_FEATURES="kexi words flow plan sheets stage tables krita karbon braindump author" CAMERAS="ptp2" COLLECTD_PLUGINS="df interface irq load memory rrdtool swap syslog" CPU_FLAGS_X86="mmx mmxext sse sse2 sse3 avx sse4_1 sse4_2 ssse3" ELIBC="glibc" GPSD_ PROTOCOLS="ashtech aivdm earthmate evermore fv18 garmin garmintxt gpsclock itrax mtk3301 nmea ntrip navcom oceanserver oldstyle oncore rtcm104v2 rtcm104v3 sirf superstar2 timing tsip tripmate tnt ublox ubx" INPUT_DEVICES="evdev" KERNEL="linux" LCD_DEVICES="bayrad cfontz cfontz633 glk hd44780 lb216 lcdm001 mtxorb ncurses text" LIBREOFFICE_EXTENSIONS="presenter-console presenter-minimizer" LINGUAS="en" OFFICE_IMPLEMENTATION="libreoffice" PHP_TARGETS="php5-5" PYTHON_SINGLE_TARGET="python2_7" PYTHON_TARGETS="python2_7 python3_3" RUBY_TARGETS="ruby19 ruby20" USERLAND="GNU" VIDEO_CARDS="nvidia" XTABLES_ADDONS="quota2 psd pknock lscan length2 ipv4options ipset ipp2p iface geoip fuzzy condition tee tarpit sysrq steal rawnat logmark ipmark dhcpmac delude chaos account" Unset: CPPFLAGS, CTARGET, EMERGE_DEFAULT_OPTS, INSTALL_MASK, LANG, LC_ALL, PORTAGE_BUNZIP2_COMMAND, PORTAGE_COMPRESS, PORTAGE_COMPRESS_FLAGS, PORTAGE_RSYNC_EXTRA_OPTS, USE_PYTHON
Starting chromium via terminal using: #chromium --no-sandbox DOES work...........but...........
I finally installed @kde-plasma so I am back to a working desktop now. And the error persists...
The error remains in www-client/chromium-42.0.2311.60
Does it work when you pass --disable-setuid-sandbox? If so, can you then open the about:sandbox page in chromium and provide the resulting table?
both people who posted snippets seem to be running as root. why would you possibly be running a web browser as root ? is anyone here running as a proper non-root user & seeing this error ?
(In reply to Mike Gilbert from comment #8) > Does it work when you pass --disable-setuid-sandbox? > > If so, can you then open the about:sandbox page in chromium and provide the > resulting table? Indeed I am running as root.I am well aware of lengthy discussions on this and propose not to reopen these. The output reads: Sandbox Status SUID Sandbox No Namespace Sandbox No PID namespaces No Network namespaces No Seccomp-BPF sandbox Yes Seccomp-BPF sandbox supports TSYNC Yes Yama LSM enforcing No You are not adequately sandboxed!
(In reply to André Terpstra from comment #10) Ok, so based on vapier's comment and your output, I'm guessing that the SUID sandbox does not work properly when running as root. I can try to reproduce that this evening. One thing you might try is getting the namespace-based sandbox working. To do so, enable the following kernel options: CONFIG_USER_NS CONFIG_PID_NS CONFIG_NET_NS
(In reply to Mike Gilbert from comment #11) > (In reply to André Terpstra from comment #10) > > Ok, so based on vapier's comment and your output, I'm guessing that the SUID > sandbox does not work properly when running as root. I can try to reproduce > that this evening. > > One thing you might try is getting the namespace-based sandbox working. To > do so, enable the following kernel options: > > CONFIG_USER_NS > CONFIG_PID_NS > CONFIG_NET_NS OK I will test this. Note that my situation before is: CONFIG_USER_NS: not selected CONFIG_PID_NS: selected (manually) CONFIG_NET_NS: selected (enforced by GENTOO_LINUX_PORTAGE [=y] && GENTOO_LINUX [=y] || GENTOO_LINUX_INIT_SYSTEMD [=n] && GENTOO_LINUX [=y] && GENTOO_LINUX_UDEV [=y]) so I will now recompile my kernel with CONFIG_USER_NS set and see whether this helps
success!
(In reply to André Terpstra from comment #10) to be clear, if you choose to run broken setups like this, it doesn't mean it's a bug in the packages that check & abort when they detect it
I don't think it is worth any effort to make SUID sandbox work when running chromium as root.
