App doesn't start on Ubuntu 24.04 with new unprivileged userns restrictions

[aripollak]

Discussed in https://github.com/johannesjo/super-productivity/discussions/3166

The error message I get from the 8.0.5 AppImage is:

[9919:0523/121338.136396:FATAL:setuid_sandbox_host.cc(158)] The SUID sandbox helper binary was found, but is not configured correctly. Rather than run without sandboxing I'm aborting now. You need to make sure that /tmp/.mount_superp8zA0mz/chrome-sandbox is owned by root and has mode 4755.
[1]    9919 trace trap (core dumped)  superproductivity

[github-actions[bot]]

Thank you very much for opening up this issue! I am currently a bit overwhelmed by the many requests that arrive each week, so please forgive me, if I fail to respond personally. I am still very likely to at least skim read your request and I'll probably try to fix all (real) bugs if possible and I will likely review every single PR being made (please, give me a heads up if you intent to do so) and I will try to work on popular requests (please upvote via thumbs up on the original issue) whenever possible, but trying to respond to every single issue over the last years has been kind of draining and I need to adjust my approach for this project to remain fun for me and to make any progress with actually coding new stuff. Thanks for your understanding!

[aripollak]

From journalctl, I get this:

kernel: audit: type=1400 audit(1716499214.956:213): apparmor="AUDIT" operation="userns_create" class="namespace" info="Userns create - transitioning profile" profile="unconfined" pid=35734 comm="superproductivi" requested="userns_create" target="unprivileged_userns"
kernel: audit: type=1400 audit(1716499214.957:214): apparmor="DENIED" operation="capable" class="cap" profile="unprivileged_userns" pid=35741 comm="superproductivi" capability=21  capname="sys_admin"

Related discussion in Bitwarden: https://github.com/bitwarden/clients/issues/5153

[johannesjo]

Does this error also occur if you start the app with superproductivity --no-sandbox?

[aripollak]

It does work with --no-sandbox, but that doesn't seem ideal since it does talk to stuff on the Internet.

[petre-dimo]

I have a similar problem with ubuntu 24.04. Osmo organizer process starts and is active but no graphic interface appears on the screen. It worked very well under ubuntu 22.04 and previous versions. After reinstalling the application, the interface stays invisible wile the process is active and can be identified with "pidof" and killed. Same behaviour if starting from terminal, with or without --no-sandof. Have you any solution ?

[aripollak]

The fix for this, similar to https://github.com/bitwarden/clients/issues/5153, is to create a new file in /etc/apparmor.d/superproductivity with the contents:

# This profile allows everything and only exists to give the
# application a name instead of having the label "unconfined"

abi <abi/4.0>,
include <tunables/global>

profile superproductivity /path/to/superproductivity flags=(unconfined) {
  userns,

  # Site-specific additions and overrides. See local/README for details.
  include if exists <local/superproductivity>
}

For Electron-based flatpak apps (like Signal Desktop), it looks like things just work because there's already a /etc/apparmor.d/flatpak file with similar contents.

[johannesjo]

Not sure what is the best way around this issue from our side. Help would be very welcome!

[aripollak]

I think the file from the example above could be included in .rpms and .debs to fix the problem on systems with either of those packages installed. But that wouldn't help the AppImage without some manual intervention by the user, since a file needs to be placed in /etc/apparmor.d. It might be naturally fixed in a snap and/or flatpak, but I'm not sure since I moved away from the snap due to #1443.

[johannesjo]

Another approach might be to re-start the app with no-sandbox if the start fails once. We then could display a warning at the start and link to a page which explains the situation and how to fix it. What do you think @aripollak? Could this work? This way we don't have to do some special handling for every different platform. And I think most problematic for Super Productivity as a whole is when new users can't start the app without fiddling around.

[aripollak]

I don't know of all the implications of running without the sandbox, but I certainly don't think that should happen automatically for an app that retrieves data from possibly untrusted sources (you probably don't want the app to end up on https://no-sandbox.io/). The solution above should work fine for .debs and .rpms, but not automatically for AppImage. Unfortunately I don't know of a safe way to make it work automatically for everyone.