[Bug]: On Linux, chrome-sandbox needs to be owned by root and mode has to be 4755

[jurgenhaas]

App Variant

Electron

Operating System & Version

Ubuntu 24.04

Issue Summary

When installing on Linux, also for updates, I always get an error message as described in the subject, and when I change ownership and mode, it works as expected.

Steps to Reproduce

After fresh installs, either from the ZIP or the AppImage, I get this error:

[28630:0611/095929.728292:FATAL:sandbox/linux/suid/client/setuid_sandbox_host.cc:166] The SUID sandbox helper binary was found, but is not configured correctly. Rather than run without sandboxing I'm aborting now. You need to make sure that /opt/CodeNomad/chrome-sandbox is owned by root and has mode 4755.

After making those changes, I can start CodeNomad as expacted.

Expected Behavior

The ownership and mode should be set out of the box.

Logs & Screenshots

No response

Additional Context

No response

[shantur]

Hey @jurgenhaas,

Thanks for raising the issue.
We will have a look

[shantur]

@CodeNomadBot

Can you check what could be the cause for this in packages/electron-app

[codenomadbot]

I checked packages/electron-app as requested.

What I found:

• Linux packaging is configured in packages/electron-app/package.json under build.linux.
• The current Linux targets are only zip and AppImage:
  • packages/electron-app/package.json:133-145
• The wrapper build script just runs electron-builder --publish=never ... for Linux:
  • packages/electron-app/scripts/build.js:158-160
• I did not find any afterPack, afterAllArtifactBuild, post-install script, chmod, chown, or package metadata that adjusts chrome-sandbox.
• The Linux release workflow uploads only *.zip and *.AppImage for the Electron build:
  • .github/workflows/build-and-upload.yml:314-338

Likely cause:

The generated Electron Linux app includes Chromium's chrome-sandbox, but our current distribution formats do not install it with the required privileged metadata. A ZIP cannot reliably preserve or apply root:root ownership, and an AppImage also cannot install a root-owned setuid helper into /opt/CodeNomad. So when the app is extracted/installed, chrome-sandbox ends up owned by the installing user and/or without mode 4755, causing Electron/Chromium to abort with:

The SUID sandbox helper binary was found, but is not configured correctly.

Recommended fix direction:

• Add a real Linux package target such as deb/rpm and configure an installer/post-install step to run:

chown root:root /opt/CodeNomad/chrome-sandbox
chmod 4755 /opt/CodeNomad/chrome-sandbox

• Keep ZIP/AppImage as portable artifacts, but document that they cannot reliably self-fix chrome-sandbox ownership without user/admin intervention.
• Avoid solving this by adding --no-sandbox unless the project explicitly accepts the security tradeoff.

I did not make code changes because the comment asked to check the cause, not implement the packaging change.

--
Yours,
CodeNomadBot