Your message dated Tue, 06 Nov 2018 10:00:12 +0000 with message-id <[email protected]> and subject line Bug#839277: fixed in chromium-browser 70.0.3538.67-3 has caused the Debian Bug report #839277, regarding chromium: sandbox won't run unless world-executable to be marked as done.
This means that you claim that the problem has been dealt with. If this is not the case it is now your responsibility to reopen the Bug report if necessary, and/or fix the problem forthwith. (NB: If you are a system administrator and have no idea what this message is talking about, this may indicate a serious mail system misconfiguration somewhere. Please contact [email protected] immediately.) -- 839277: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=839277 Debian Bug Tracking System Contact [email protected] with problems
--- Begin Message ---Package: chromium Version: 53.0.2785.113-1 Severity: wishlist /usr/lib/chromium/chrome-sandbox won't run unless it's world-executable, due to this code in sandbox/linux/suid/client/setuid_sandbox_host.cc: if (access(sandbox_binary.c_str(), X_OK) != 0 || (st.st_uid != 0) || ((st.st_mode & S_ISUID) == 0) || ((st.st_mode & S_IXOTH)) == 0) { LOG(FATAL) << "The SUID sandbox helper binary was found, but is not " "configured correctly. Rather than run without sandboxing " "I'm aborting now. You need to make sure that " << sandbox_binary << " is owned by root and has mode 4755."; } Please remove the last check (IXOTH). System accounts like 'nobody' and 'lp' should never run the sandbox, so I've used chgrp and 'chmod o-x' to ensure only users with GUI access can run it on my system. And it works as long as this check is disabled. The access() check should be enough, anyway, to verify it will run. I'm not sure the other checks are useful either--a similar message could instead be printed when execve() fails or the sandbox sees EPERM/EACCES. The sandbox itself looks like it will try to continue when geteuid()!=0, until something important actually fails; this might let it work without being setuid if the administrator has enabled filesystem capabilities or unprivileged namespaces. - Michael -- System Information: Debian Release: stretch/sid APT prefers unstable APT policy: (500, 'unstable') Architecture: amd64 (x86_64) Foreign Architectures: arm64, mips, i386 Kernel: Linux 4.7.0-1-amd64 (SMP w/8 CPU cores) Locale: LANG=en_CA.UTF-8, LC_CTYPE=en_CA.UTF-8 (charmap=UTF-8) Shell: /bin/sh linked to /bin/dash Init: sysvinit (via /sbin/init) Versions of packages chromium depends on: ii libasound2 1.1.2-1 ii libatk1.0-0 2.22.0-1 ii libavcodec57 7:3.1.3-1+b3 ii libavformat57 7:3.1.3-1+b3 ii libavutil55 7:3.1.3-1+b3 ii libc6 2.24-3 ii libcairo2 1.14.6-1+b1 ii libcups2 2.2.0-2 ii libdbus-1-3 1.10.10-1 ii libexpat1 2.2.0-1 ii libfontconfig1 2.11.0-6.7 ii libfreetype6 2.6.3-3+b1 ii libgcc1 1:6.2.0-4 ii libgdk-pixbuf2.0-0 2.36.0-1 ii libglib2.0-0 2.50.0-1 ii libgnome-keyring0 3.12.0-1+b1 ii libgtk-3-0 3.22.0-1 ii libharfbuzz0b 1.2.7-1+b1 ii libjpeg62-turbo 1:1.5.1-1 ii libnettle6 3.2-1 ii libnspr4 2:4.12-6 ii libnss3 2:3.26-2 ii libpango-1.0-0 1.40.3-2 ii libpangocairo-1.0-0 1.40.3-2 ii libpci3 1:3.3.1-1.1 ii libpulse0 9.0-3 ii libspeechd2 0.8.5-1 ii libstdc++6 6.2.0-4 ii libx11-6 2:1.6.3-1 ii libxcomposite1 1:0.4.4-1 ii libxcursor1 1:1.1.14-1+b1 ii libxdamage1 1:1.1.4-2+b1 ii libxext6 2:1.3.3-1 ii libxfixes3 1:5.0.2-1 ii libxi6 2:1.7.6-1 ii libxml2 2.9.4+dfsg1-2 ii libxrandr2 2:1.5.0-1 ii libxrender1 1:0.9.9-2 ii libxslt1.1 1.1.29-1 ii libxss1 1:1.2.2-1 ii libxtst6 2:1.2.2-1+b1 ii x11-utils 7.7+3 ii xdg-utils 1.1.1-1 Versions of packages chromium recommends: ii fonts-liberation 1:1.07.4-2 Versions of packages chromium suggests: pn chromium-l10n <none> -- no debconf information
signature.asc
Description: PGP signature
--- End Message ---
--- Begin Message ---Source: chromium-browser Source-Version: 70.0.3538.67-3 We believe that the bug you reported is fixed in the latest version of chromium-browser, which is due to be installed in the Debian FTP archive. A summary of the changes between this version and the previous one is attached. Thank you for reporting the bug, which will now be closed. If you have further comments please address them to [email protected], and the maintainer will reopen the bug report if appropriate. Debian distribution maintenance software pp. Michael Gilbert <[email protected]> (supplier of updated chromium-browser package) (This message was generated automatically at their request; if you believe that there is a problem with it please contact the archive administrators by mailing [email protected]) -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Sat, 03 Nov 2018 17:30:16 +0000 Source: chromium-browser Binary: chromium chromium-l10n chromium-shell chromium-driver chromium-common chromium-sandbox Architecture: source amd64 all Version: 70.0.3538.67-3 Distribution: unstable Urgency: medium Maintainer: Debian Chromium Team <[email protected]> Changed-By: Michael Gilbert <[email protected]> Description: chromium - web browser chromium-common - web browser - common resources used by the chromium packages chromium-driver - web browser - WebDriver support chromium-l10n - web browser - language packs chromium-sandbox - web browser - setuid security sandbox for chromium chromium-shell - web browser - minimal shell Closes: 839277 Changes: chromium-browser (70.0.3538.67-3) unstable; urgency=medium . * Fix a compiler warning. * Move the setuid sandbox into a separate package (closes: #839277). Checksums-Sha1: d3b7eff4b09cdc83957d3cb0f4b2e04504b3bd67 4286 chromium-browser_70.0.3538.67-3.dsc 8218ef10a06ddd61416772e0b55472c93cbadea0 164392 chromium-browser_70.0.3538.67-3.debian.tar.xz 7e443964242061ece85bdd899f90ff77e61298dd 24432 chromium-browser_70.0.3538.67-3_amd64.buildinfo 5b7baee25b66560e0654898921d4270b21d6a1f7 331996 chromium-common_70.0.3538.67-3_amd64.deb fab9ba0b8990ce9be6943f5d21c43f049027185e 17846912 chromium-dbgsym_70.0.3538.67-3_amd64.deb 2e605660938f71eca7bfde8bda32dc4c6c2f7830 2124180 chromium-driver-dbgsym_70.0.3538.67-3_amd64.deb 03c9af9587c508e8709ee81da848b2d56724dc68 3950240 chromium-driver_70.0.3538.67-3_amd64.deb b4ed2185b36d611084b75b9bf0949fa5308f8077 2909324 chromium-l10n_70.0.3538.67-3_all.deb 7bd1a84bb5afb1bb708b07846d3ddcb08e4666eb 17200 chromium-sandbox-dbgsym_70.0.3538.67-3_amd64.deb 1e99e666547adb436256a83781d53e64dde5a48d 136012 chromium-sandbox_70.0.3538.67-3_amd64.deb 160d4a08b57b66a0b0462c29416e4761b4130518 15215464 chromium-shell-dbgsym_70.0.3538.67-3_amd64.deb cb97a383100d12eda5d233dc3367f5691f936cd0 28779096 chromium-shell_70.0.3538.67-3_amd64.deb eea0dfd222c2fc47feea91121ea4860698dcc271 42208280 chromium_70.0.3538.67-3_amd64.deb Checksums-Sha256: 7a82549806ae42970167b2c81676a9d096ecb1d4722bf222e391f45b8016b0da 4286 chromium-browser_70.0.3538.67-3.dsc e399c3d2adef7e45ac4c6d48698cc0692c85cdcf6dcd7f64089d2337d29ae3a5 164392 chromium-browser_70.0.3538.67-3.debian.tar.xz 3ab1caf369be1cb54a00fe216ae3beee95beacbc4d74e80dec83bdb4483eb5f1 24432 chromium-browser_70.0.3538.67-3_amd64.buildinfo bf16e8845364c5455cf4d818ed2c4e83342ef85ab7a63f2697eab6375a8dd4e8 331996 chromium-common_70.0.3538.67-3_amd64.deb 4ed329a7c44be5540125d84bc5b5e51cdaf61a81ed0864b51634b3ea702e7a63 17846912 chromium-dbgsym_70.0.3538.67-3_amd64.deb c19ffa6fa424163e520462b1b67907815037e0158c4fa74078891477821e5798 2124180 chromium-driver-dbgsym_70.0.3538.67-3_amd64.deb a6e9acc3ba346b79422a2a2be328e8d299c672c6e9c4b0a5cc6e98e228e7ef37 3950240 chromium-driver_70.0.3538.67-3_amd64.deb a953c9f6de339bf9ebe3bbaaf22a5fe9b8cad4500d3191564c6973810c092209 2909324 chromium-l10n_70.0.3538.67-3_all.deb 60e6f03be07b3fe733c2b7813e4bde057239db00fa57750522933c7164d6125d 17200 chromium-sandbox-dbgsym_70.0.3538.67-3_amd64.deb 2008e655661b7f435665e957f2ea404492a7cc9322b90bfd143bc91c3375418d 136012 chromium-sandbox_70.0.3538.67-3_amd64.deb c63c6f92368a39750606642681739f424719025821fdd1e277e98bf1a9ad928f 15215464 chromium-shell-dbgsym_70.0.3538.67-3_amd64.deb a86539e2c135122214587f5d5f9f8a092e0fe0c61061d973c51960cd31318321 28779096 chromium-shell_70.0.3538.67-3_amd64.deb 307e4699279e08be9cec0991204e10c633eca7d2bc65dcc640cd22f9f3bd430c 42208280 chromium_70.0.3538.67-3_amd64.deb Files: 8fe45af090ad7f49c35e4ea262af0f1c 4286 web optional chromium-browser_70.0.3538.67-3.dsc 5debfd04c2bb94f6364a8c6bbcbc38c8 164392 web optional chromium-browser_70.0.3538.67-3.debian.tar.xz ffe4d97cea7d5e3e0182420331d38f0e 24432 web optional chromium-browser_70.0.3538.67-3_amd64.buildinfo 751e34dfcb7ac712f0481f18b75ad1e7 331996 web optional chromium-common_70.0.3538.67-3_amd64.deb f6c3b32180ea3cb24472dbeb8f07c0fb 17846912 debug optional chromium-dbgsym_70.0.3538.67-3_amd64.deb 23ce6b79536e0f83f5c91da6efbd8218 2124180 debug optional chromium-driver-dbgsym_70.0.3538.67-3_amd64.deb beac3a2f010ab4dae6bceb8bc86d451d 3950240 web optional chromium-driver_70.0.3538.67-3_amd64.deb 521a5c7f978e48aa86179e9771230e1e 2909324 localization optional chromium-l10n_70.0.3538.67-3_all.deb be13b4cce51a180cdb14d851d89c6fc2 17200 debug optional chromium-sandbox-dbgsym_70.0.3538.67-3_amd64.deb d41fc03056fef9f5d8ac86bf58c56246 136012 web optional chromium-sandbox_70.0.3538.67-3_amd64.deb 3a256abf6c4c8b0762d3fd9ed25d6a18 15215464 debug optional chromium-shell-dbgsym_70.0.3538.67-3_amd64.deb fd3d2c1c71ac88f377502f7e9c50ad51 28779096 web optional chromium-shell_70.0.3538.67-3_amd64.deb 6b6df0e6965b2805459b3ce522f67d12 42208280 web optional chromium_70.0.3538.67-3_amd64.deb -----BEGIN PGP SIGNATURE----- iQQzBAEBCgAdFiEEluhy7ASCBulP9FUWuNayzQLW9HMFAlve+mYACgkQuNayzQLW 9HNcRR//Wb9LGqITf+hPrSstmYAH6g/KBx0x3JdNv04JJXsbkj0w00ZrGxMrrkKg mQkIlxhF7UpfZwh1jiE/m+WcbqT43l/BFXql0O1ROn1RD0up48ajpBzRkl3AAT9e eatZ7+uDNvJnxeaV77M0fhcaAUSBH3YtCJVuYDK3txLiCZTR7Ml6WkSaf80x240T 4PVTgG05UEmAjccOSCI/tCLEHUNBmdpUSb/zis4zDv3M0VHrlzUXff7B2s3E7nc4 KbHBhEoGRK1oF/q5xD4iV1aslt/Q7vsRlb1E+apWynCsdORfPcXPtAkmKdZ41R10 i/XbvZSy4vd883m6V0rAIFNwaFpfulLYryejbdWIWW9+PbjX/fwlFBi1Cvh4IkXG IYLEw87zww5mvwuwsgPAwQLqWqtb9XNeyDN05msG2JF6QwDVk3fb6ikw8549yzB0 gmxfClyOQ44pyGOrCU97Jvlryh7qovBPTOC24CkgBPDptxPjbiIA9XwG0fpeWA2Y iQT0Nfadm4XNIy8TBqryse6dc1WJdfxGq98B7aFn3rsKsMgKypQ/lwf1ynZeVemQ 6D+cHzIdS0slG1URdYzlP6FCSz8mIbVldZbecBrlEILpxXO24/1pfpBkUX/PsyDZ i8zToUJo04DHoARL00paKPE1wD232hFbdD1X9D0iarWZgnFq8v1ZEtie85Ke8kkH SK7M5TIXvYr3cGSWQ6AJm+cQaLn1RZPw5EpEoZ0GBWOTGgnnBz0UnlNCRYK6VeoF GxF0nFtwg5i95t1bJLTcbrOWKeoOInQBUXCPZ06BKIaC1BW3BrAQwiHij94Cil3J XE1AjQ8AGKLUnU0x4EUehTiQG6r9sMgZ4aN+cgy3eyjS91PInE0gF4p9RVhhmuiY Gs9uNV2L5WBkci7d16oR+L9ethmxxbpoqLYszmgfa5ou3m2NKBQpFfG6u72I2m2L OVr3LpiNxzHZNF1n3XFEmEkOQ1bZNUKBc5JCuHTj12cZIQcPtm1zvURhpHl4h1pY OzG7s+u8hFv4o2FSQj3/f+VYYAxZGDqKorMZeTpUNBNJZnhlDPp9N+CBtEKHTgDr hhYMSufkQWWUL+ReZ3pknfZMjd2FbtAzDfr903BYLbt9ZQcLNQMx91bws6mt8GXN Vx4YDi5Yl0BgTScNQ73xkjKF7hm3TaSd3l+2Q3+NEQcohbBCvJyuvQVlx+2R+XZ8 gbEmXk4/lE4a8SZDCBJ+k06Jc8FLMQqxFq1WnSAKw3oLbN9DnVR4Fu5xOvBNDqp+ M8Fc4QMreCk7yF3loblbTCpMIQRcawzxVmLmWJM0WFKRocRshkyef939Ij49+OkB /OZKPmF9vnszCj3cU9bxiiID7ZOE9A== =Q1Z6 -----END PGP SIGNATURE-----
--- End Message ---
