From bee5901f7a04d17c40e2c8d077437f10e59c8d81 Mon Sep 17 00:00:00 2001 From: Christophe Besson Date: Wed, 2 Sep 2026 11:47:51 +0200 Subject: build(client): say when a build has reset the local chrome-sandbox MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `build-client.sh` runs `npm ci`, which deletes node_modules wholesale, then re-extracts Electron's dist. A chrome-sandbox that had been made root-owned 4755 for local development comes back 755 and owned by whoever ran the build. Running the app straight from node_modules then aborts outright: FATAL: The SUID sandbox helper binary was found, but is not configured correctly. Rather than run without sandboxing I'm aborting now. Chromium refusing to start beats it quietly dropping the sandbox, and that refusal is baffling if the crash is not connected to a package build run minutes earlier — the two look unrelated, and the file's own mtime is 1980 either way, so nothing on it points at what happened. The build now says so, with the command to put it back. Said and not done: a build script has no business setting a setuid bit behind someone's back, and this one uses no sudo. The packaged app was never affected — packaging/deb/meshbay-client/DEBIAN/postinst does the chown+chmod at install time, which is where it belongs. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_014UtzVrzM7e2tG9fSpkR9ML --- packaging/build/build-client.sh | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) (limited to 'packaging/build') diff --git a/packaging/build/build-client.sh b/packaging/build/build-client.sh index fbdf51e..d42000a 100755 --- a/packaging/build/build-client.sh +++ b/packaging/build/build-client.sh @@ -114,3 +114,23 @@ cp "$REPO/packaging/firewall/firewalld/meshbay-cast.xml" \ "$ROOT/usr/lib/firewalld/services/" echo "==> meshbay-client staging ready at $ROOT ($DEB_ARCH)" + +# `npm ci` above deletes node_modules wholesale and install.js re-extracts +# Electron's dist, so a chrome-sandbox that had been made root-owned 4755 for +# local development comes back 755, owned by whoever ran this build. Running +# the app straight from node_modules then aborts outright — Chromium refuses +# to run without its SUID helper rather than quietly dropping the sandbox, +# which is the right call and a baffling one if you have not connected the +# crash to a package build you ran minutes earlier. +# +# Said, not done: this script does not use sudo, and a build is not where a +# setuid bit should be set behind someone's back. The *packaged* app is +# unaffected — packaging/deb/meshbay-client/DEBIAN/postinst does it at +# install time, which is where it belongs. +SANDBOX="$CLIENT/node_modules/electron/dist/chrome-sandbox" +if [ -e "$SANDBOX" ] && [ ! -u "$SANDBOX" ]; then + echo + echo " NOTE: this build reset $SANDBOX to $(stat -c '%a %U:%G' "$SANDBOX")." + echo " Running Electron from node_modules needs it back:" + echo " sudo chown root:root '$SANDBOX' && sudo chmod 4755 '$SANDBOX'" +fi -- cgit v1.2.3