Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

Packaging Electron v5 with sandbox (linux)

See original GitHub issue

With electron 5 the sandbox is enabled by default. The sandbox requires elevated rights to run. This can be achieved if the kernel has kernel.unprivileged_userns_clone enabled or a SUID flag is set on chrome-sandbox.

If unprivileged_userns_clone is disabled (default for Arch) the SUID-flag is required.

To disable / enable said kernel feature:

sudo sysctl kernel.unprivileged_userns_clone=0

Snaps cannot use the SUID flag (automatic app review) and seem to prevent access to the kernel feature.

One can disable the sandbox by running electron with the --no-sandbox argument.

As a workaround, I currently use an after-pack hook to wrap the electron binary and append the --no-sandbox argument, which seemed to be to be the only way to add the sandbox argument. (app.commandLine.appendSwitch does not work since electron has already launched) https://github.com/thomasnordquist/MQTT-Explorer/blob/master/scripts/afterPack.ts

Electron issue concerning this: https://github.com/electron/electron/issues/17972

Issue Analytics

State:
Created 4 years ago
Reactions:9
Comments:95 (35 by maintainers)

Top GitHub Comments

5reactions

christianbundycommented, Nov 28, 2019

@develar I think this issue should be re-opened. It’s great that #4364 resolves this for the .deb distribution, but this problem remains unsolved on AppImage (and maybe Snap?).

2reactions

jwhearecommented, Jul 29, 2019

@develar please can you reopen this issue so it can be resolved for AppImage/deb/etc or would you prefer a new issue is opened? Happy to do so if needed.

Top Results From Across the Web

Process-Sandboxing - Electron.js

Process-Sandboxing. One key security feature in Chromium is that processes can be executed within a sandbox. The sandbox limits the harm that malicious...

electron-builder | Yarn - Package Manager

A complete solution to package and build a ready for distribution Electron app for MacOS, Windows and Linux with “auto update” support out...

The ultimate Electron guide - Debug & Release

Using our same example as a file explorer, let's explore how we can create or delete files beginning with Electron v5.

A Letter to Discord for not Supporting the Linux Desktop

The Discord client uses an Electron version that is questionably low. In this article, we're going to look at PipeWire and Wayland compatibility ......

Electron packager tutorial - Christian Engvall

In this tutorial I package the application on Windows, macOS and Ubuntu Linux. There are some information about building Windows apps from non- ......