https://bugs.kde.org/show_bug.cgi?id=523214
--- Comment #13 from Ralf Habacker <[email protected]> --- (In reply to Ralf Habacker from comment #12) > (In reply to [email protected] from comment #5) > > > [10213:10213:0718/120559.983523:FATAL:ndbox/linux/services/credentials.cc: > > 133] Check failed: . : Permission denied (13) >From an AI research: The relevant Chromium component is sandbox/linux/services/credentials.cc. It manipulates Linux credentials and namespaces (setgroups, user namespaces, etc.) as part of constructing the renderer sandbox. On modern Linux, Chromium's sandbox needs, among other things: unprivileged user namespaces; seccomp-bpf; permission to perform the relevant namespace/credential operations. Qt explicitly documents these requirements for Qt WebEngine. It also states that Qt WebEngine does not use the old setuid sandbox on Linux. So: FATAL: sandbox/linux/services/credentials.cc:133 Check failed: . : Permission denied (13) essentially means: Chromium attempted a sandbox credential/namespace operation and the kernel/container security policy returned EPERM/EACCES. The particularly interesting case nowadays is Ubuntu 24.04 and derivatives: AppArmor can restrict unprivileged user namespaces even when the kernel itself supports them. This produces exactly the kind of credentials.cc failure you're seeing. There are examples of Chromium/Electron applications being fixed by allowing userns in an AppArmor profile rather than disabling the Chromium sandbox. -- You are receiving this mail because: You are watching all bug changes.
