https://bugzilla.novell.com/show_bug.cgi?id=718016 https://bugzilla.novell.com/show_bug.cgi?id=718016#c Ludwig Nussel changed: What |Removed |Added ---------------------------------------------------------------------------- Priority|P5 - None |P2 - High -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=718016 https://bugzilla.novell.com/show_bug.cgi?id=718016#c3 --- Comment #3 from Raymond Wooninck 2011-09-15 11:40:47 UTC --- I can move the helper to any required location, as that the guidance is done by setting an environment variable. I could patch chromium to continue without sandbox until this is reviewed. However I don't know if this wouldn't cause more security issues as that we might get into the situation where through Chromium access to the filesystem could be obtained. There seems to be an alternative (using seccomp for the sandbox) however the indications are that this is pushing the performance drastically (up to 4000%) down. (outlined in http://code.google.com/p/chromium/issues/detail?id=36133) -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=718016 https://bugzilla.novell.com/show_bug.cgi?id=718016#c5 --- Comment #5 from Raymond Wooninck 2011-09-15 12:09:55 UTC --- Exactly my idea. I have changed the spec file so that it no longer sets the SUID bit on the helper and ensure that Chromium sandbox is no longer used. Once this gets accepted in Factory, I will switch the helper on again, so that people can switch to use the browser from the network:chromium repo in a more secure way. Thanks for your help and please let me know if you need any additional info. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=718016 https://bugzilla.novell.com/show_bug.cgi?id=718016#c7 --- Comment #7 from Raymond Wooninck 2011-09-15 17:02:07 UTC --- Thanks. I have adjusted the statements that I already had in the spec-file to the ones indicated. Also I moved the file to the correct location /usr/lib as indicated by Ludwig. Currently the file is building in network:chromium and when completed/correct building I will submit the package to Factory. It was already legally approved, etc, so that inclusion could happen fast. At least in time for the Beta 1 milestone. Once this exception has been approved, I only need to remove a small statement to enable the sandbox again. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

From what I've seen during the review, the suid code is OK. It changed during

https://bugzilla.novell.com/show_bug.cgi?id=718016 https://bugzilla.novell.com/show_bug.cgi?id=718016#c9 --- Comment #9 from Sebastian Krahmer 2011-09-19 14:32:00 UTC --- past (formerly chrooting to /tmp/ subdir, now to /proc/pid/fd) and is using tricky mechanisms. Basically the suids sandbox is also available as a separate project: http://code.google.com/p/setuid-sandbox/source/browse/trunk/sandboxme.c?r=13 So I have no problem making it suid and this bug can probably closed then. We need to re-check if they change the code again, of course. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=718016 https://bugzilla.novell.com/show_bug.cgi?id=718016#c11 --- Comment #11 from Ludwig Nussel 2011-09-20 10:18:08 CEST --- Normally you wouldn't need to do anything as the setuid bit will magically appear when I submit a permissions package. However, since you added that hardcoded --no-sandbox you will need to resubmit chromium to remove the parameter again I guess. Note that chromium must be able to deal with a missing setuid bit on the helper at at run time. An admin is free to change security level and not have the setuid bit set. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=718016 https://bugzilla.novell.com/show_bug.cgi?id=718016#c12 --- Comment #12 from Raymond Wooninck 2011-09-20 08:39:42 UTC --- Ok. Then I will replace the hardcoded parameter by a routine that determines if the helper has the setuid bit or not. If it is not set, then it adds the --no-sandbox parameter. This should be able to take care of most situations. Thanks for your help. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=718016 https://bugzilla.novell.com/show_bug.cgi?id=718016#c14 --- Comment #14 from Ludwig Nussel 2011-09-20 15:36:02 CEST --- better include a file e.g. /etc/permissions.d/chromium.easy that sets the setuid bit in older distros. Then set the badness of the resulting rpmlint message to zero. Any rpmlintrc that suppresses permission errors won't be accepted in Factory. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=718016 https://bugzilla.novell.com/show_bug.cgi?id=718016#c16 --- Comment #16 from Bernhard Wiedemann 2011-09-20 18:00:21 CEST --- This is an autogenerated message for OBS integration: This bug (718016) was mentioned in https://build.opensuse.org/request/show/83945 Factory / permissions -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=718016 https://bugzilla.novell.com/show_bug.cgi?id=718016#c18 Ludwig Nussel changed: What |Removed |Added ---------------------------------------------------------------------------- Status|ASSIGNED |RESOLVED Resolution| |FIXED --- Comment #18 from Ludwig Nussel 2011-09-21 10:03:39 CEST --- oops, that was a copy&paste error. /usr/lib is correct of course. fixed now. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=718016 https://bugzilla.novell.com/show_bug.cgi?id=718016#c20 Raymond Wooninck changed: What |Removed |Added ---------------------------------------------------------------------------- Status|RESOLVED |VERIFIED --- Comment #20 from Raymond Wooninck 2011-09-21 09:37:18 UTC --- Bug is indeed resolved. Tested it locally and everything works. Thanks !! -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=718016 https://bugzilla.novell.com/show_bug.cgi?id=718016#c22 --- Comment #22 from Bernhard Wiedemann 2013-08-21 16:00:13 CEST --- This is an autogenerated message for OBS integration: This bug (718016) was mentioned in https://build.opensuse.org/request/show/195811 Factory / permissions -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.