[kmymoney] [Bug 523214] KMyMoney shuts down when trying to open "Configure KMyMoney" from the configuration menu

https://bugs.kde.org/show_bug.cgi?id=523214

--- Comment #13 from Ralf Habacker <[email protected]> ---
(In reply to Ralf Habacker from comment #12)
> (In reply to [email protected] from comment #5)
> 
> > [10213:10213:0718/120559.983523:FATAL:ndbox/linux/services/credentials.cc:
> > 133] Check failed: . : Permission denied (13)

From an AI research: 

The relevant Chromium component is sandbox/linux/services/credentials.cc. It
manipulates Linux credentials and namespaces (setgroups, user namespaces, etc.)
as part of constructing the renderer sandbox.

On modern Linux, Chromium's sandbox needs, among other things:

unprivileged user namespaces;
seccomp-bpf;
permission to perform the relevant namespace/credential operations.

Qt explicitly documents these requirements for Qt WebEngine. It also states
that Qt WebEngine does not use the old setuid sandbox on Linux.

So:

FATAL: sandbox/linux/services/credentials.cc:133
Check failed: . : Permission denied (13)

essentially means:

Chromium attempted a sandbox credential/namespace operation and the
kernel/container security policy returned EPERM/EACCES.

The particularly interesting case nowadays is Ubuntu 24.04 and derivatives:
AppArmor can restrict unprivileged user namespaces even when the kernel itself
supports them. This produces exactly the kind of credentials.cc failure you're
seeing. There are examples of Chromium/Electron applications being fixed by
allowing userns in an AppArmor profile rather than disabling the Chromium
sandbox.

-- 
You are receiving this mail because:
You are watching all bug changes.