{"action":"created","issue":{"url":"https://api.github.com/repos/NixOS/nixpkgs/issues/17460","repository_url":"https://api.github.com/repos/NixOS/nixpkgs","labels_url":"https://api.github.com/repos/NixOS/nixpkgs/issues/17460/labels{/name}","comments_url":"https://api.github.com/repos/NixOS/nixpkgs/issues/17460/comments","events_url":"https://api.github.com/repos/NixOS/nixpkgs/issues/17460/events","html_url":"https://github.com/NixOS/nixpkgs/issues/17460","id":169011435,"number":17460,"title":"chromium won't start under a grsecurity kernel","user":{"login":"obadz","id":3359345,"avatar_url":"https://avatars.githubusercontent.com/u/3359345?v=3","gravatar_id":"","url":"https://api.github.com/users/obadz","html_url":"https://github.com/obadz","followers_url":"https://api.github.com/users/obadz/followers","following_url":"https://api.github.com/users/obadz/following{/other_user}","gists_url":"https://api.github.com/users/obadz/gists{/gist_id}","starred_url":"https://api.github.com/users/obadz/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/obadz/subscriptions","organizations_url":"https://api.github.com/users/obadz/orgs","repos_url":"https://api.github.com/users/obadz/repos","events_url":"https://api.github.com/users/obadz/events{/privacy}","received_events_url":"https://api.github.com/users/obadz/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/NixOS/nixpkgs/labels/0.kind:%20bug","name":"0.kind: bug","color":"84b6eb"},{"url":"https://api.github.com/repos/NixOS/nixpkgs/labels/6.topic:%20grsecurity","name":"6.topic: grsecurity","color":"fef2c0"}],"state":"open","locked":false,"assignee":{"login":"joachifm","id":41977,"avatar_url":"https://avatars.githubusercontent.com/u/41977?v=3","gravatar_id":"","url":"https://api.github.com/users/joachifm","html_url":"https://github.com/joachifm","followers_url":"https://api.github.com/users/joachifm/followers","following_url":"https://api.github.com/users/joachifm/following{/other_user}","gists_url":"https://api.github.com/users/joachifm/gists{/gist_id}","starred_url":"https://api.github.com/users/joachifm/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/joachifm/subscriptions","organizations_url":"https://api.github.com/users/joachifm/orgs","repos_url":"https://api.github.com/users/joachifm/repos","events_url":"https://api.github.com/users/joachifm/events{/privacy}","received_events_url":"https://api.github.com/users/joachifm/received_events","type":"User","site_admin":false},"assignees":[{"login":"joachifm","id":41977,"avatar_url":"https://avatars.githubusercontent.com/u/41977?v=3","gravatar_id":"","url":"https://api.github.com/users/joachifm","html_url":"https://github.com/joachifm","followers_url":"https://api.github.com/users/joachifm/followers","following_url":"https://api.github.com/users/joachifm/following{/other_user}","gists_url":"https://api.github.com/users/joachifm/gists{/gist_id}","starred_url":"https://api.github.com/users/joachifm/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/joachifm/subscriptions","organizations_url":"https://api.github.com/users/joachifm/orgs","repos_url":"https://api.github.com/users/joachifm/repos","events_url":"https://api.github.com/users/joachifm/events{/privacy}","received_events_url":"https://api.github.com/users/joachifm/received_events","type":"User","site_admin":false}],"milestone":null,"comments":36,"created_at":"2016-08-02T23:18:18Z","updated_at":"2016-08-04T18:36:39Z","closed_at":null,"body":"## Issue description\r\n\r\nRunning chromium with a grsecurity kernel yields the error:\r\n\r\n```\r\n[1500:1500:0802/235641:FATAL:setuid_sandbox_host.cc(162)] The SUID sandbox helper binary was found, but is not configured correctly. Rather than run without sandboxing I'm aborting now. You need to make sure that /nix/store/6xhfxlrnjwq8f54qpmzp9c0jjpxya8b0-chromium-51.0.2704.103/libexec/chromium/chrome-sandbox is owned by root and has mode 4755.\r\n#0 0x002b7fe2835e base::debug::StackTrace::StackTrace()\r\n#1 0x002b7fe3ccde logging::LogMessage::~LogMessage()\r\n#2 0x002b82971a1e sandbox::SetuidSandboxHost::PrependWrapper()\r\n#3 0x002b8273d895 content::ZygoteCommunication::Init()\r\n#4 0x002b8273debe content::CreateZygote()\r\n#5 0x002b827beb54 content::BrowserMainLoop::EarlyInitialization()\r\n#6 0x002b825e406b content::BrowserMainRunnerImpl::Initialize()\r\n#7 0x002b825e3303 content::BrowserMain()\r\n#8 0x002b7fdfbbad content::ContentMainRunnerImpl::Run()\r\n#9 0x002b7fdfb081 content::ContentMain()\r\n#10 0x002b7fa3a8da ChromeMain\r\n#11 0x039130667770 __libc_start_main\r\n#12 0x002b7fa3a789 _start\r\n``` \r\n\r\n\r\n### Steps to reproduce\r\n\r\n```bash\r\n$ cat > test.nix << EOF\r\n{ config, pkgs, ... }:\r\n\r\n{\r\n  # The two misbehaving kids\r\n  security.grsecurity.enable = true;\r\n  environment.systemPackages = with pkgs; [ chromium ];\r\n\r\n  # Some X environment\r\n  services.xserver.enable = true;\r\n  services.xserver.displayManager.lightdm.enable = true;\r\n  services.xserver.windowManager.i3.enable = true;\r\n\r\n  # A user\r\n  users.extraUsers.testUser = {\r\n    isNormalUser = true;\r\n    uid = 1000;\r\n    password = \"\";\r\n  };\r\n}\r\nEOF\r\n$ nixos-rebuild build-vm -I nixos-config=./test.nix && ./result/bin/run-nixos-vm \r\n```\r\n\r\nLogin as `testUser`, pop open a terminal (Mod4+Enter), invoke `chromium-browser`.\r\n\r\n## Technical details\r\n\r\n* System: NixOS\r\n* Nixpkgs version: 26a2392\r\n\r\ncc @aszlig @thoughtpolice @joachifm"},"comment":{"url":"https://api.github.com/repos/NixOS/nixpkgs/issues/comments/237643556","html_url":"https://github.com/NixOS/nixpkgs/issues/17460#issuecomment-237643556","issue_url":"https://api.github.com/repos/NixOS/nixpkgs/issues/17460","id":237643556,"user":{"login":"obadz","id":3359345,"avatar_url":"https://avatars.githubusercontent.com/u/3359345?v=3","gravatar_id":"","url":"https://api.github.com/users/obadz","html_url":"https://github.com/obadz","followers_url":"https://api.github.com/users/obadz/followers","following_url":"https://api.github.com/users/obadz/following{/other_user}","gists_url":"https://api.github.com/users/obadz/gists{/gist_id}","starred_url":"https://api.github.com/users/obadz/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/obadz/subscriptions","organizations_url":"https://api.github.com/users/obadz/orgs","repos_url":"https://api.github.com/users/obadz/repos","events_url":"https://api.github.com/users/obadz/events{/privacy}","received_events_url":"https://api.github.com/users/obadz/received_events","type":"User","site_admin":false},"created_at":"2016-08-04T18:36:38Z","updated_at":"2016-08-04T18:36:38Z","body":"```\r\n$ grep -b vycrgv9bbaawvfz69lac6avl860yg15h-chromium-52.0.2743.116 ./chrome-sandbox \r\n$ ./chrome-sandbox \r\nUsage: ./chrome-sandbox <renderer process> <args...>\r\n```\r\n\r\nLooks like the sandbox does not have any reference to Chrome's `$out` and takes the rendering process as an argument. Should be relatively easy to factor out as a separate output and package a NixOS module this so that it's SUID.\r\n\r\n"}}
{"actor":{"display_login":"obadz"}}