18

I installed Puppeteer to use it in the generation of pdf / minuatures, but I can not activate and configure Chrome Linux Sandbox. Always the same error message :

(node:46) UnhandledPromiseRejectionWarning: Error: Failed to launch chrome! [1208/055442.253403:FATAL:zygote_host_impl_linux.cc(116)] No usable sandbox! Update your kernel or see https://chromium.googlesource.com/chromium/src/+/master/docs/linux_suid_sandbox_development.md for more information on developing with the SUID sandbox. If you want to live dangerously and need an immediate workaround, you can try using --no-sandbox.

I followed the steps mentioned in the official documentation, but without success 

# cd to the downloaded instance
cd <project-dir-path>/node_modules/puppeteer/.local-chromium/linux-<revision>/chrome-linux/
sudo chown root:root chrome_sandbox
sudo chmod 4755 chrome_sandbox
# copy sandbox executable to a shared location
sudo cp -p chrome_sandbox /usr/local/sbin/chrome-devel-sandbox
# export CHROME_DEVEL_SANDBOX env variable
export CHROME_DEVEL_SANDBOX=/usr/local/sbin/chrome-devel-sandbox
Paul Verest
  • 60,022
  • 51
  • 208
  • 332
mahdi
  • 219
  • 1
  • 3
  • 11

2 Answers2

10

Try with 

sudo sysctl -w kernel.unprivileged_userns_clone=1

It will allows you, as unprivileged user, to access the sandbox of chromium. This is temporary and active only until reboot.

Hexdump
  • 159
  • 1
  • 7
  • 3
    This article suggests this is a significant security window best kept closed. Is there any other way of running a headless chrome? https://security.stackexchange.com/questions/209529/what-does-enabling-kernel-unprivileged-userns-clone-do – rgammans Jun 07 '21 at 11:01
  • @rgammans OP was probably on the right track but lost the `setuid` bit after `cp`, see my answer below. – Skippy le Grand Gourou Feb 11 '22 at 22:50
0

You likely have the setuid bit wrong because of the cp command :

$ sudo touch orig
$ ls -l orig
-rw-r--r-- 1 root root 0 févr. 11 23:31 orig
$ sudo chmod 4755 orig
$ ls -l orig
-rwsr-xr-x 1 root root 0 févr. 11 23:31 orig
$ sudo cp orig new
$ ls -l new
-rwxr-xr-x 1 root root 0 févr. 11 23:31 new

The setuid bit (4th character) was changed from s to x after cp.

Skippy le Grand Gourou
  • 6,976
  • 4
  • 60
  • 76