Repository navigation
fix(sandbox): detect restricted worker namespaces and fall back to one-shot sandboxes - #1954
Conversation
…e-shot sandboxes Verify nested namespace capabilities during persistent worker initialization. If restricted by environment security policies (such as AppArmor unpriv_bwrap on Ubuntu 24.04 and elementary OS 8), disable persistent workers and gracefully fall back to one-shot bubblewrap decoders. Closes #1926
|
Needs changes. The fix targets the right cause, but there are three problems: any spawn error now turns off persistent workers for the rest of the session, the diagnostics finding blames the wrong thing, and the new tests race on a shared global flag. The root cause is handled correctly. Should fix1. Any spawn failure turns off persistent workers for the whole process (
Before this PR the error went back to the caller and the next lease retried. The worker returns 2. Diagnostics blame Landlock on systems that support it ( When workers were disabled by the namespace probe, the check reports The same wrong message also appears without rendering whenever thumbnails tripped the fallback before Diagnostics was opened. In that case Suggested fix:
3.
Neither test restores the flag if an assertion panics. Suggested fix: pass the post-render state into 4. The browser test only exercises the flag, not the new behaviour ( The test checks the setter/getter and the existing 5. The sandbox docs still describe Landlock as the only trigger ( The docs say the pool keeps one-shot sandboxes "On systems without Landlock ABI 3". They should also cover the startup namespace probe, the ready handshake, and the fact that a restricted environment falls back for the rest of the session. Nits
|
Review and cleanupPrepared locally, not pushed: Merged Feedback addressed
ValidationCoverage includes startup/protocol policy, both pool callers, source protection, diagnostic classification/presentation/report copying, catalogs, real worker reuse/replacement/retirement, and preview rendering. The merge brought dependency/QA-harness changes, so full pinned suites were also run. Existing pinned image/storage and build caches were reused; GUI checks used private displays/buses.
Manual inspection through Pending owner decision: authorize pushing with the documented unrelated baseline failure, or handle the notification/window test failures separately first. No validation override has been assumed. |
|
LGTM @wmfeht |
Persistent workers were disabled for the rest of the process after any startup error, including temporary ones such as EMFILE, EAGAIN or a slow start, and Diagnostics blamed a missing Landlock ABI 3 even on kernels that support it. The supervisor now reports a namespace permission denial explicitly in its startup handshake. Only that answer switches the pool to one-shot sandboxes; other startup failures fail the request and the next one retries. Diagnostics distinguishes restricted namespaces from missing Landlock (translated in all catalogs) and receives the support state as an argument instead of tests toggling a global flag. The browser worker QA scenarios detect either fallback by its shared log phrase. Refs #1926
Review fixes pushedMerged Review findings and how they were addressed
Validation
Reproduced and verified on Ubuntu 24.04 with AppArmor
|
ReviewMerged FindingsI re-read the whole diff against the updated
Nothing merge-blocking found. The PR description still describes the first revision (always falling back on spawn failure, reporting Validation (review worktree, Podman)
I did not have an AppArmor-restricted host; the restricted path relies on the unit tests plus the Ubuntu 24.04 reproduction already recorded above. |
Description
On Ubuntu 24.04 and elementary OS 8, AppArmor's
unpriv_bwrapprofile transitions unprivilegedbwrapchildren into a profile that denies nested namespace creation (unshare(CLONE_NEWNS)returnsEPERM). Becauseworkers_supported()previously only verified Landlock ABI 3 availability, Strata assumed persistent workers were functional, causing persistent workers to fail on startup and leaving thumbnails and previews in an unhandled failure state.This change:
verify_namespaces()) in the browser worker supervisor that tests namespace unsharing before entering the control loop, cleanly failing early with exit code 1 if blocked.ProcessWorker::spawn()so worker capability failures are detected synchronously.Commandhandle immediately upon child launch so socket EOF is delivered without waiting for the 12-second timeout.preview-helper) and disables persistent workers viadisable_workers()when persistent workers cannot be spawned.LandlockUnavailablewarning instead of problem/crash when workers are restricted.Visual evidence
How to test
unpriv_bwrapAppArmor profile active).F1-> Diagnostics).Expected result:
Thumbnails and previews load cleanly using one-shot sandboxes without decoder error messages or crashes. Diagnostics reports Sandboxed Workers with a warning rather than failing or reporting false success.
Related issue
Closes #1926