Subject: chromium/chrome in a vserver guest?
From: Christian Jaeger <chrjae@gmail.com>
Date: Thu, 1 Dec 2011 14:32:48 -0500

Hello

I'm successfully (and maybe even securely) using Xorg in a vserver
guest (I'll add more details to the wiki about X soon). The one
problem I haven't found a solution so far is running chromium.

$ chromium-browser
Failed to move to new PID namespace: Operation not permitted
^C

$ chromium-browser --no-sandbox
[12306:12306:699047412629:ERROR:renderer_main.cc(213)] Running without
renderer sandbox
# works but that's obviously suboptimal

Now I've read that chrome/chromium has been and still is using seccomp
for their sandbox on Linux [1][2], at least in some configuration or
part of its sandboxing; now for the part where it does indeed use
seccomp, to my understanding there would be no use for PID namespaces
(seccomp would inhibit access to syscalls concerning PIDs), so that
leaves me to suspect they either use namespaces in the part outside
the seccomp'ed thread, or that chromium from Debian stable and testing
are relying on something else than seccomp.

I can't verify whether seccomp is being used with strace on a
non-vserver machine, as that too makes it run into the "Failed to move
to new PID namespace: Operation not permitted" error.

Does anyone know more, or has found a solution to running chromium
with sandboxing?

Christian.

[1] http://www.imperialviolet.org/2009/08/26/seccomp.html
[2] http://code.google.com/p/chromium/issues/detail?id=104084