standard-notes-3.0.16-x86_64 runs only with --no-sandbox

[CorbeauCrypto]

When attempting to run Standard Notes from the desktop, it will silently fail. When one attempts to run it via the command-line the following output is received:

./standard-notes-3.0.16-x86_64.AppImage
[10639:0914/100115.798855:FATAL:setuid_sandbox_host.cc(157)] The SUID sandbox helper binary was found, but is not configured correctly. Rather than run without sandboxing I'm aborting now. You need to make sure that /tmp/.mount_standaE8QNfO/chrome-sandbox is owned by root and has mode 4755.

The output from tailing /var/log/syslog is as follows:

Sep 14 10:12:54 CORBEAUCRYPTO kernel: [ 6516.716996] traps: standard-notes[10890] trap int3 ip:5573409e4057 sp:7ffeee322c80 error:0 in standard-notes[55733eac0000+5024000]
Sep 14 10:12:54 CORBEAUCRYPTO systemd[1599]: tmp-.mount_standaKaUD1q.mount: Succeeded.
Sep 14 10:12:54 CORBEAUCRYPTO systemd[1]: tmp-.mount_standaKaUD1q.mount: Succeeded.
Sep 14 10:12:54 CORBEAUCRYPTO systemd[1010]: tmp-.mount_standaKaUD1q.mount: Succeeded.

Attempts to remediate the issue is as follows:

• Uninstall and reinstall Standard Notes per the instructions posted here https://standardnotes.org/help/72/how-do-i-uninstall-standard-notes
• Uninstalled Chromium and Google Chrome in case Standard Notes was borrowing a sandbox from /opt/google-chrome (not the case)
• Checked the permissions of the /tmp folder
• Also checked other reported issues such as App crashes in ubuntu 14.04.1 #362 for any potential overlap (did not find any)

Environment:

• Kali GNU/Linux Rolling (5.2.0-kali2-amd64 Welcome to the Standard Notes discussion forum #1 SMP Debian 5.2.9-2kali1 (2019-08-22) x86_64 GNU/Linux)
• Gnome 3.30.2

Please do let me know if there's any additional information I can provide to assist. Or steps I need to perform. Thank you.

[shinanqu]

I have the same issues, the same error message. (MX Linux 18.3, XFCE)
I reinstalled 3.0.15 and it's fine.

[CorbeauCrypto]

@shinanqu - thank you. That saves me from having to start Standard Notes differently from other apps. I appreciate it. I will keep the 3.0.16 App Image on my computer and I will continue to monitor this issue to see if I can help with the fix. Thanks again.

[merkin3k]

I'm seeing the same issue with standard-notes-3.0.16-x86_64.AppImage with:
Debian GNU/Linux 9.11 (stretch), Xfce 4.12.3
Debian GNU/Linux 10 (buster), Xfce 4.12.5
The previous release, standard-notes-3.0.15-x86_64.AppImage, works fine in both cases.

Also, standard-notes-3.0.16-x86_64.AppImage works fine with:
Ubuntu 18.04.3 LTS, GNOME 3.28.4
Linux Mint 19.1 Tessa, Cinnamon 4.0.10
Fedora release 29 (Twenty Nine), KDE Plasma 5.14.5.1
Fedora release 30 (Thirty), KDE Plasma 5.15.5

Thanks, and cheers!

[moughxyz]

Surprisingly no good vendor solution for this. Requires user OS configuration.

You can start the app from the command line with:

$ /your/path/standard-notes-3.0.16-x86_64.AppImage --no-sandbox

Possible workarounds (via electron/electron#17972 (comment))

1. Enable unprivileged access to CLONE_NEWUSER in your kernel. Some kernels support changing this with sysctl kernel.unprivileged_userns_clone=1.

2. Disable sandboxing entirely by launching with --no-sandbox. Adding this argument from JS is unfortunately insufficient, as the GPU process is launched before the main process JS is run.

electron/electron#17972 (comment)
electron/electron#17972
bitwarden/desktop#286
electron-userland/electron-builder#3872

[merkin3k]

Hi Mo:
Adding "--no-sandbox" to the launcher(s) allows standard-notes-3.0.16-x86_64.AppImage run on my Debian 9 and Debian 10 Xfce instances.
Thanks!

[affe42]

From security point of view, instead of running Standard Notes with "--no-sandbox", it would be better to enable the kernel feature "user namespaces", which Mobitar also mentioned. The actual method to do this varies between distros. For PureOS I managed to do it by adding the line..

kernel.unprivileged_userns_clone=1

..to one of the .conf-files located at folder /etc/sysctl.d/

The command sysctl -w kernel.unprivileged_userns_clone=1 would probably do the the same thing (haven't tested that yet).

Discussion about this can be found here:

https://unix.stackexchange.com/questions/303213/how-to-enable-user-namespaces-in-the-kernel-for-unprivileged-unshare

https://superuser.com/questions/1094597/enable-user-namespaces-in-debian-kernel

[merkin3k]

Hi affe42:

Thanks to your extra nudge, I went down the "user namespaces" rabbit hole a bit and did a bunch of reading. It now makes sense to me why enabling "user namespaces" is a better solution, so...

I removed "--no-sandbox" from my launchers (and confirmed that the issue came back). Then I created:
/etc/sysctl.d/00-local-userns.conf
with the following contents:
kernel.unprivileged_userns_clone=1

After rebooting, standard-notes-3.0.16-x86_64.AppImage now launches without issue on both of my Debian 9 and Debian 10 instances. I'll add this detail to my Debian configuration notes...which I keep in Standard Notes, of course. ;)

Thanks!

[Correcaminos406]

I have the same issues, the same error message. (MX Linux 18.3, XFCE)
I reinstalled 3.0.15 and it's fine.

I had the same idea but cannot find older versions of SN yet

[merkin3k]

I have the same issues, the same error message. (MX Linux 18.3, XFCE)
I reinstalled 3.0.15 and it's fine.

I had the same idea but cannot find older versions of SN yet

You should be able to download SN 3.0.15 from here:
https://github.com/standardnotes/desktop/releases/tag/v3.0.15

You might have to expand "Assets" to see the downloads. Hope this helps.

[moughxyz]

If you choose to downgrade to 3.0.15, be sure you are only doing so if you have your notes synced to your account. 3.0.15 and 3.0.16 use different underlying storage mechanisms, and are not backward compatible, so your local data may be wiped.

[Correcaminos406]

If you chose to downgrade to 3.0.15, be sure you are only doing so if you have your notes synced to your account. 3.0.15 and 3.0.16 use different underlying storage mechanisms, and are not backward compatible, so your local data may be wiped.

It did work fine for me yesterday (I did not loose anything) but now it is not working... I am currently updating on the web editor but i is not nice.
Do you consider sending a new version or should I make a deeper testing? I do not have a lot of free time today!

[emaddaou]

Thank you all, switched to root using sudo -i and ran the following one line, then reboot. It works perfect.

echo 'kernel.unprivileged_userns_clone=1' > /etc/sysctl.d/00-local-userns.conf

[Correcaminos406]

This works fine, no system crash - until now! - and I finally recover the access to standardnotes app.
Still completely mysterious for me!?

[IhorLitvinov]

From security point of view, instead of running Standard Notes with "--no-sandbox", it would be better to enable the kernel feature "user namespaces", which Mobitar also mentioned. The actual method to do this varies between distros.

I have found a completely opposite point of view:

Enabling unprivileged user namespaces opens up severe vulnerabilities in the Linux kernel. If you did not intend to enable it, you should ensure it is disabled. Numerous vulnerabilities that are found regularly are often only exploitable if unprivileged user namespaces are supported and enabled by the kernel.

---

Also, there is an additional information about the packaging that might help solve this issue.

snap is works now out of the box, for appimage, there is a hard written code:
electron-userland/electron-builder#3872 (comment)

Maybe it's time to release a snap package? :) standardnotes/desktop#250

[Correcaminos406]

Maybe it's time to release a snap package? :) standardnotes/desktop#250

I do understand this technical post in very general terms nevertheless the conclusion is very clear.
I also would like to see an alternative solution for SN (for me the best note app until now) and possibly a snap package which is quite usable for a mean user.
Then, please let us know how to close the option (suppose that it is the same instruction ending with =0)?

[acsipak]

Standard Notes is now available as a snap package:

https://snapcraft.io/standard-notes

[caffeine-1]

The snap is running with the --no-sandbox flag. Check running processes after launching SN.