Not working on Debian 10 SUID Error

[stevavoliajvar]

Hi,

I wan’t to try out radicle, downloaded app and sadly system won’t run it.
I am running Debian 10.
The error I get is this:

[7207:1205/234345.685735:FATAL:setuid_sandbox_host.cc(158)] The SUID sandbox helper binary was found, but is not configured correctly. Rather than run without sandboxing I'm aborting now. You need to make sure that /tmp/.mount_radiclHy5nT5/chrome-sandbox is owned by root and has mode 4755.
Trace/breakpoint trap

I cannot chmod that file, it’s like it doesn’t exist, tried with sudo and everything.

My guess is that this is some Electron problem.

Any ideas on how to fix this ?

[xla]

I had the same issue on my Debian computer. I couldn’t find a “good” workaround, but running the AppImage with --no-sandbox got it to open.

[wschwab]

+1 on the issue, also on Debian. This error often comes up in Electron, I second @stevavoliajvar 's guess. I'd rather not disable the sandbox.

Update: Hmmm, I just discovered this thread about the same issue in a different AppImage, there commenters suggest running --no-sandbox isn't a security issue, at least not moreso than using Electron in the first place.

Here's another resource on the issue, the third solution should work for Debian users, though I don't know what the security ramifications are, nor are they mentioned in the article. The issue thread from Patchwork (linked above) also considered this as an option in their .deb packages, though, which gives the impression that it's not incredibly insecure, but DYOR.

[barak]

You can fix it like this:

$ sudo sysctl kernel.unprivileged_userns_clone=1

Don't worry it's not actually doing anything scary. It enables appimage's preferred security mechanism. If that preferred mechanism is not enabled, it falls back to the nasty old sandbox thing, which also fails with that sandbox error message.

Running with --no-sandbox totally disables security, eek, scary, this is a better solution.

[barak]

And do this if you want it to persist across boots:

$ echo 'kernel.unprivileged_userns_clone=1' | sudo tee --append /etc/sysctl.d/local.conf