Zoom fail to start either because of missing pulseaudio or SUID issue. Version 5.11.3.3882 output shown below, version 5.11.3.3882 output differs a bit (mention pacmd instead of pactl - this is already reported in https://bugs.gentoo.org/863623, but my issue is different because I don't use pulseaudio at all). The main issue is I've disabled pulseaudio USE flag, so neither pactl nor pacmd should be called at all: [ebuild R ~] net-im/zoom-5.11.1.3595::gentoo USE="bundled-qt -bundled-libjpeg-turbo -opencl -pulseaudio -wayland" 0 KiB NOTE: No matter below output says "zoom started" - it's not started. $ zoom sh: line 1: pactl: command not found Class App Lib Possible Culprit Flags resip::Connection 648 648 resip::Data 36 36 resip::DnsResult 1080 1080 resip::Headers 1 1 resip::MsgHeaderScanner 40 40 resip::SipMessage 5208 5208 resip::TransportSelector 864 864 resip::Tuple 128 128 resip::UdpTransport 1144 1144 resip::GenericIPAddress 28 28 zoom started. [0826/104715.776473:FATAL:setuid_sandbox_host.cc(158)] The SUID sandbox helper binary was found, but is not configured correctly. Rather than run without sandboxing I'm aborting now. You need to make sure that /opt/zoom/cef/chrome-sandbox is owned by root and has mode 4755. [1] 9303 trace trap LANG= zoom sh: line 1: pactl: command not found Class App Lib Possible Culprit Flags resip::Connection 648 648 resip::Data 36 36 resip::DnsResult 1080 1080 resip::Headers 1 1 resip::MsgHeaderScanner 40 40 resip::SipMessage 5208 5208 resip::TransportSelector 864 864 resip::Tuple 128 128 resip::UdpTransport 1144 1144 resip::GenericIPAddress 28 28 zoom started. $ ls -l /opt/zoom/cef/chrome-sandbox -rw-r--r-- 1 root root 1597080 Aug 26 10:36 /opt/zoom/cef/chrome-sandbox Portage 3.0.30 (python 3.10.6-final-0, default/linux/amd64/17.1/hardened, gcc-11.3.0, glibc-2.35-r8, 5.15.59-gentoo x86_64) ================================================================= System uname: Linux-5.15.59-gentoo-x86_64-AMD_Ryzen_9_5900X_12-Core_Processor-with-glibc2.35 KiB Mem: 32813220 total, 1014324 free KiB Swap: 16776896 total, 16756416 free Timestamp of repository gentoo: Fri, 26 Aug 2022 07:00:01 +0000 Head commit of repository gentoo: 88be1426a77e29fc463ec982241856d2ec721365 sh bash 5.1_p16-r1 ld GNU ld (Gentoo 2.38 p4) 2.38 ccache version 4.5.1 [enabled] app-misc/pax-utils: 1.3.4::gentoo app-shells/bash: 5.1_p16-r1::gentoo dev-java/java-config: 2.3.1::gentoo dev-lang/perl: 5.34.1-r3::gentoo dev-lang/python: 3.9.13_p4::gentoo, 3.10.6_p2::gentoo dev-lang/rust: 1.62.1::gentoo dev-util/ccache: 4.5.1::gentoo dev-util/cmake: 3.22.4::gentoo dev-util/meson: 0.62.2::gentoo sys-apps/baselayout: 2.8::gentoo sys-apps/sandbox: 2.29::gentoo sys-devel/autoconf: 2.13-r2::gentoo, 2.71-r1::gentoo sys-devel/automake: 1.16.5::gentoo sys-devel/binutils: 2.38-r2::gentoo sys-devel/binutils-config: 5.4.1::gentoo sys-devel/clang: 14.0.6-r1::gentoo sys-devel/gcc: 11.3.0::gentoo sys-devel/gcc-config: 2.5-r1::gentoo sys-devel/libtool: 2.4.7::gentoo sys-devel/lld: 14.0.6::gentoo sys-devel/llvm: 14.0.6-r2::gentoo sys-devel/make: 4.3::gentoo sys-kernel/linux-headers: 5.15-r3::gentoo (virtual/os-headers) sys-libs/glibc: 2.35-r8::gentoo sys-libs/libselinux: 3.4::gentoo Repositories: gentoo location: /usr/portage sync-type: rsync sync-uri: rsync://rsync.gentoo.org/gentoo-portage priority: -1000 sync-rsync-verify-jobs: 1 sync-rsync-extra-opts: sync-rsync-verify-max-age: 24 sync-rsync-verify-metamanifest: yes local location: /usr/local/portage masters: gentoo priority: 0 powerman location: /home/powerman/proj/gentoo/powerman-overlay masters: gentoo priority: 50 steam-overlay location: /var/lib/layman/steam-overlay sync-type: laymansync sync-uri: https://github.com/anyc/steam-overlay.git masters: gentoo priority: 50 torbrowser location: /var/lib/layman/torbrowser sync-type: laymansync sync-uri: https://github.com/MeisterP/torbrowser-overlay.git masters: gentoo priority: 50 Installed sets: @esteam ACCEPT_KEYWORDS="amd64" ACCEPT_LICENSE="*" CBUILD="x86_64-pc-linux-gnu" CFLAGS="-march=native -O2 -pipe" CHOST="x86_64-pc-linux-gnu" CONFIG_PROTECT="/etc /service /usr/lib64/libreoffice/program/sofficerc /usr/share/config /usr/share/easy-rsa /usr/share/gnupg/qualified.txt /usr/share/i2p/scripts /usr/share/maven-bin-3.8/conf /var/log" CONFIG_PROTECT_MASK="/etc/ca-certificates.conf /etc/dconf /etc/env.d /etc/fonts/fonts.conf /etc/gconf /etc/gentoo-release /etc/revdep-rebuild /etc/sandbox.d /etc/terminfo" CXXFLAGS="-march=native -O2 -pipe" DISTDIR="/usr/portage-distfiles" EMERGE_DEFAULT_OPTS="--with-bdeps=y --autounmask --autounmask-write --alert=y" ENV_UNSET="CARGO_HOME DBUS_SESSION_BUS_ADDRESS DISPLAY GOBIN GOPATH PERL5LIB PERL5OPT PERLPREFIX PERL_CORE PERL_MB_OPT PERL_MM_OPT XAUTHORITY XDG_CACHE_HOME XDG_CONFIG_HOME XDG_DATA_HOME XDG_RUNTIME_DIR" FCFLAGS="-march=native -O2 -pipe" FEATURES="assume-digests binpkg-docompress binpkg-dostrip binpkg-logs buildpkg-live ccache clean-logs config-protect-if-modified distlocks ebuild-locks fixlafiles ipc-sandbox merge-sync multilib-strict network-sandbox news parallel-fetch pid-sandbox preserve-libs protect-owned qa-unresolved-soname-deps sandbox sfperms strict strict-keepdir unknown-features-warn unmerge-logs unmerge-orphans userfetch userpriv usersandbox usersync xattr" FFLAGS="-march=native -O2 -pipe" GENTOO_MIRRORS="http://mirror.leaseweb.com/gentoo/ http://mirrors.aliyun.com/gentoo/ http://ftp.snt.utwente.nl/pub/os/linux/gentoo" LANG="ru_RU.utf8" LDFLAGS="-Wl,-O1 -Wl,--as-needed" LINGUAS="en ru ru_RU" MAKEOPTS="-j24" PKGDIR="/usr/portage-packages" PORTAGE_CONFIGROOT="/" PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --omit-dir-times --compress --force --whole-file --delete --stats --human-readable --timeout=180 --exclude=/distfiles --exclude=/local --exclude=/packages --exclude=/.git" PORTAGE_TMPDIR="/var/tmp" SHELL="/bin/zsh" USE="X a52 aac acl acpi aes alac alsa amd64 avx avx2 bash-completion bluetooth branding bzip2 cairo caps cdda cddb cdr chm cli crypt cups dbus dcron dga djvu dri dts dvb dvd dvdr egl eglfs elogind emboss encode exif f16c fam ffmpeg flac fma3 fontconfig gallium gdbm gif gpg gtk hardened heif iconv icu id3tag idn ipv6 jpeg jpeg2k lcms libglvnd libnotify libtirpc mac mad matroska mmx mmxext mng mp3 mp4 mpeg mtp multilib musepack ncurses network-cron nls nptl nsplugin ogg opengl openmp opus pam pango pclmul pcre pdf perl pie png policykit popcnt ppds qt5 rdrand readline rtc sdl seccomp sha spell split-usr sse sse2 sse3 sse4_1 sse4_2 sse4a ssl ssp ssse3 startup-notification svg tcpd theora tiff truetype udev udisks unicode upower usb vaapi vdpau vim-syntax vorbis wavpack wxwidgets x264 x265 xattr xcb xml xscreensaver xtpax xv xvid xvmc zlib" ABI_X86="64" ADA_TARGET="gnat_2020" APACHE2_MODULES="log_config vhost_alias autoindex alias rewrite dir deflate filter mime negotiation auth_basic authn_file authz_host authz_user authz_groupfile cgi actions headers env setenvif authn_core authz_core unixd socache_shmcb access_compat" CALLIGRA_FEATURES="karbon sheets words" COLLECTD_PLUGINS="df interface irq load memory rrdtool swap syslog" CPU_FLAGS_X86="aes avx avx2 f16c fma3 mmx mmxext pclmul popcnt rdrand sha sse sse2 sse3 sse4_1 sse4_2 sse4a ssse3" ELIBC="glibc" GPSD_PROTOCOLS="ashtech aivdm earthmate evermore fv18 garmin garmintxt gpsclock greis isync itrax mtk3301 nmea ntrip navcom oceanserver oldstyle oncore rtcm104v2 rtcm104v3 sirf skytraq superstar2 timing tsip tripmate tnt ublox ubx" GRUB_PLATFORMS="efi-64 pc" INPUT_DEVICES="evdev" KERNEL="linux" L10N="en ru" LCD_DEVICES="bayrad cfontz cfontz633 glk hd44780 lb216 lcdm001 mtxorb ncurses text" LIBREOFFICE_EXTENSIONS="presenter-console presenter-minimizer" LUA_SINGLE_TARGET="lua5-1" LUA_TARGETS="lua5-1" NGINX_MODULES_HTTP="access auth_basic autoindex browser charset empty_gif fastcgi geo gzip limit_conn limit_req map memcached proxy referer rewrite scgi split_clients ssi upstream_ip_hash userid uwsgi addition fancyindex" NGINX_MODULES_STREAM="ssl_preread map" OFFICE_IMPLEMENTATION="libreoffice" PHP_TARGETS="php5-6 php7-0" POSTGRES_TARGETS="postgres12 postgres13" PYTHON_SINGLE_TARGET="python3_9" PYTHON_TARGETS="python3_10 python3_9" QEMU_SOFTMMU_TARGETS="x86_64 i386" QEMU_USER_TARGETS="x86_64 i386" RUBY_TARGETS="ruby27" USERLAND="GNU" VIDEO_CARDS="nvidia nouveau" XTABLES_ADDONS="quota2 psd pknock lscan length2 ipv4options ipset ipp2p iface geoip fuzzy condition tee tarpit sysrq proto steal rawnat logmark ipmark dhcpmac delude chaos account" Unset: ADDR2LINE, AR, ARFLAGS, AS, ASFLAGS, CC, CCLD, CONFIG_SHELL, CPP, CPPFLAGS, CTARGET, CXX, CXXFILT, ELFEDIT, EXTRA_ECONF, F77FLAGS, FC, GCOV, GPROF, INSTALL_MASK, LC_ALL, LD, LEX, LFLAGS, LIBTOOL, MAKE, MAKEFLAGS, NM, OBJCOPY, OBJDUMP, PORTAGE_BINHOST, PORTAGE_BUNZIP2_COMMAND, PORTAGE_COMPRESS, PORTAGE_COMPRESS_FLAGS, PORTAGE_RSYNC_EXTRA_OPTS, RANLIB, READELF, RUSTFLAGS, SIZE, STRINGS, STRIP, YACC, YFLAGS
After `chmod 04755 /opt/zoom/cef/chrome-sandbox` zoom has started. Is it required to make it SUID? If yes, then why ebuild didn't mention this? It still output errors related to pacmd. $ zoom sh: line 1: pactl: command not found Class App Lib Possible Culprit Flags resip::Connection 648 648 resip::Data 36 36 resip::DnsResult 1080 1080 resip::Headers 1 1 resip::MsgHeaderScanner 40 40 resip::SipMessage 5208 5208 resip::TransportSelector 864 864 resip::Tuple 128 128 resip::UdpTransport 1144 1144 resip::GenericIPAddress 28 28 zoom started. sh: line 1: pactl: command not found sh: line 1: pactl: command not found Class App Lib Possible Culprit Flags resip::Connection 648 648 resip::Data 36 36 resip::DnsResult 1080 1080 resip::Headers 1 1 resip::MsgHeaderScanner 40 40 resip::SipMessage 5208 5208 resip::TransportSelector 864 864 resip::Tuple 128 128 resip::UdpTransport 1144 1144 resip::GenericIPAddress 28 28 Class App Lib Possible Culprit Flags resip::Connection 648 648 resip::Data 36 36 resip::DnsResult 1080 1080 resip::Headers 1 1 resip::MsgHeaderScanner 40 40 resip::SipMessage 5208 5208 resip::TransportSelector 864 864 resip::Tuple 128 128 resip::UdpTransport 1144 1144 resip::GenericIPAddress 28 28 zoom started. zoom started. Client: Breakpad is using Single Client Mode! client fd = -1 sh: line 1: pactl: command not found [CZPClientLogMgr::LogClientEnvironment] [MacAddr: 1C:6F:65:C5:D6:D7][client: Linux][OS: Gentoo Linux x64][Hardware: CPU Core:12 Frenquency:3.7 G Memory size:32044MB CPU Brand:AMD Ryzen 9 5900X 12-Core Processor GPU Brand:][Req ID: ] sh: line 1: pactl: command not found Linux Client Version is 5.11.1 (3595) QSG_RENDER_LOOP is XDG_CURRENT_DESKTOP = ; GDMSESSION = ; XDG_SESSION_TYPE = x11 Graphics Card Info:: 0b:00.0 VGA compatible controller: NVIDIA Corporation GA104 [GeForce RTX 3060 Ti Lite Hash Rate] (rev a1) Zoom package arch is 64bit, runing OS arch is x86_64 AppIconMgr::systemDesktopName log Desktop Name: Class App Lib Possible Culprit Flags resip::Connection 648 648 resip::Data 36 36 resip::DnsResult 1080 1080 resip::Headers 1 1 resip::MsgHeaderScanner 40 40 resip::SipMessage 5208 5208 resip::TransportSelector 864 864 resip::Tuple 128 128 resip::UdpTransport 1144 1144 resip::GenericIPAddress 28 28 sh: line 1: pactl: command not found zoom started.
Do you have CONFIG_USER_NS enabled on your kernel? It's needed for sandbox to work without SUID root. e.g. discord-bin has a CONFIG_CHECK for this, but this ebuild doesn't which it probably should fix If not that, USER_NS can be finicky in chroot if you're using that.
# zgrep USER_NS /proc/config.gz CONFIG_USER_NS=y
And no, I don't chroot zoom.
Is this still an issue with zoom-5.11.9.4300? If yes, please report the problem upstream. This is a proprietary binary-only package, so there is little that we can do on the distro side.
(In reply to Ulrich Müller from comment #5) > Is this still an issue with zoom-5.11.9.4300? If yes, please report the > problem upstream. Yes, this is still an issue with zoom-5.11.9.4300. > This is a proprietary binary-only package, so there is little that we can do > on the distro side. To me this sounds weird. If it were a bug in a Zoom app itself - you'll be right. But it's a Gentoo ebuild provide USE=-pulseaudio feature, so it's probably ebuild's responsibility to patch shell scripts starting Zoom to make sure they won't call pactl when this USE flag is disabled. And I suppose SUID issue is similar: ebuild should either mark it SUID (because it doesn't work otherwise) or at least output some warning message about how to make it work without SUID. Both issues unlikely can be solved upstream.
(In reply to Alex Efros from comment #6) > But it's a Gentoo ebuild provide USE=-pulseaudio feature, so it's probably > ebuild's responsibility to patch shell scripts starting Zoom to make sure > they won't call pactl when this USE flag is disabled. Not going to happen. Report the problem upstream please.
Also, looks like it is an upstream regression. Previous versions of zoom didn't have that problem.
The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=2d6c37fb8246955389f3c57544bebae341db8cbd commit 2d6c37fb8246955389f3c57544bebae341db8cbd Author: Ulrich Müller <ulm@gentoo.org> AuthorDate: 2022-08-27 19:28:10 +0000 Commit: Ulrich Müller <ulm@gentoo.org> CommitDate: 2022-08-27 19:28:10 +0000 net-im/zoom: Check kernel configuration Bug: https://bugs.gentoo.org/866626#c2 Signed-off-by: Ulrich Müller <ulm@gentoo.org> net-im/zoom/zoom-5.11.9.4300-r2.ebuild | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
> net-im/zoom: Check kernel configuration FYI: I've all of these enabled, but it still doesn't work without SUID. # zgrep USER_NS /proc/config.gz CONFIG_USER_NS=y # zgrep PID_NS /proc/config.gz CONFIG_PID_NS=y # zgrep NET_NS /proc/config.gz CONFIG_NET_NS=y # CONFIG_NET_NSH is not set # zgrep SECCOMP_FILTER /proc/config.gz CONFIG_HAVE_ARCH_SECCOMP_FILTER=y CONFIG_SECCOMP_FILTER=y
