Building electron linux distro : The SUID sandbox helper binary was found, but is not configured correctly

Question

I am generating electron distro for linux. This is how the app is built This is how app is built in packge.json

 "builderForLinx": "electron-packager --out linx64 --overwrite --platform linux --appname myApp --asar"  

this app structure myApp -> myApp(the linux executable), mian.js, resources -> myApp.asar

This gives an linux version electron package. But I have to run the following commands to run the app

sudo chmod +x ./myApp
sudo chown root chrome-sandbox
sudo chmod 4755 chrome-sandbox

Actually I get the app from tfs build artifact and when I download this app, I want to directly run ./myApp.

This is my tfs definition, I run all these in bash, not my agent/build machines are windows ones.

#!/bin/bash 
cd "$(Build.ArtifactStagingDirectory)/myApp" ; pwd
chown <<username>> chrome-sandbox
chmod 4755 chrome-sandbox

Note : $(Build.ArtifactStagingDirectory) is the tfs variable which points to artifact directory. When I run the app directly in linux machine I see this error

The SUID sandbox helper binary was found, but is not configured correctly. Rather than run without sandboxing I'm aborting now. You need to make sure that /home/staff/kjeeva/licregsNew/v211/licensingclient/linx64/ClientSettings-asar/chrome-sandbox is owned by root and has mode 4755.

I am not well versed with linux environment, any help or suggestions on this will be great help.

Answer 1

The SUID sandbox helper binary was found ... seems to be one hot issue about electron framework in Linux. You can check this discussion for more details.

Here're the available workarounds from that discussion:

1.chown and chmod the file first like what you did.

sudo chown root chrome-sandbox
chmod 4755 chrome-sandbox

2.If you get one appimage, you can run it directly with --no-sandbox arguemnt

3.sysctl kernel.unprivileged_userns_clone=1 to enable unprivileged access.

You've already used #1, but you can also check if #2/#3 is more suitable for your scenario.

This is my tfs definition, I run all these in bash, not my agent/build machines are windows ones.

Since part of your agents are Linux and others are Windows, I recommend you can use Conditions to manage the bash tasks. You can have two different bash tasks/steps, one for Linux and another for Windows. And then set their conditions to run correct commands conditionally. Something like this:

- task: Bash@3
  inputs:
    targetType: 'inline'
    script: |
      # Write commands here
      # ...
  displayName: 'Bash command for Linux'
  condition: and(succeeded(), eq(variables['Agent.OS'], 'Linux'))

- task: Bash@3
  inputs:
    targetType: 'inline'
    script: |
      # Write commands here
      # ...
  displayName: 'Bash command for Windows'
  condition: and(succeeded(), eq(variables['Agent.OS'], 'Windows_NT'))

About predefined variable Agent.OS, you can check this document.