FATAL Unable to start riot 1.3.2 after upgrade

[532910]

% riot-web 
[19945:0806/110917.237662:FATAL:setuid_sandbox_host.cc(157)] The SUID sandbox helper binary was found, but is not configured correctly. Rather than run without sandboxing I'm aborting now. You need to make sure that /opt/Riot/chrome-sandbox is owned by root and has mode 4755.

% l /opt/Riot/chrome-sandbox 
-rwxr-xr-x 1 root root 5.0M 2019-08-05 17:15 /opt/Riot/chrome-sandbox*

% apt policy riot-web 
riot-web:
  Installed: 1.3.2
  Candidate: 1.3.2
  Version table:
 *** 1.3.2 500
        500 https://packages.riot.im/debian sid/main amd64 Packages
        100 /var/lib/dpkg/status

[jryans]

What was the version you upgraded from?

[532910]

1.3.0 IIRC

[SISheogorath]

Same problem appears on flatpak: flathub/im.riot.Riot#59

And I was able to reproduce the issue locally as well. I wonder if we can do anything to help here.

[jryans]

We did upgrade to Electron 5 as part of the recent release, so it could be related to this.

[jryans]

It seems related to this issue reported to electron-builder. I see some workarounds suggests to run Electron with --no-sandbox, but I am not sure the best to apply that. Could someone affected try some of the workarounds mentioned there?

[532910]

% riot-web --no-sandbox works

[jryans]

Looking at the related Electron issue, what about if you do:

$ sudo sysctl kernel.unprivileged_userns_clone=1

and then test running riot-web without any special sandbox options? This enables an OS feature called CLONE_NEWUSER, you can read more about it.

The above sysctl setting is the default on Ubuntu 18.04, but it may not be enabled on your distro.

[532910]

yes, it works with kernel.unprivileged_userns_clone=1. Looks like it's 0 by default on debian systems.

[jryans]

Okay, it's good to know there are several possible approaches to get Riot working. This seems to be something that would affect any app using Electron 5 or later.

We'll keep watching the Electron packaging tools for any news on the right way to bake in a workaround for this issue, but for now I would suggest using one of the workarounds mentioned above.