{"action":"opened","issue":{"url":"https://api.github.com/repos/NixOS/nixpkgs/issues/5730","labels_url":"https://api.github.com/repos/NixOS/nixpkgs/issues/5730/labels{/name}","comments_url":"https://api.github.com/repos/NixOS/nixpkgs/issues/5730/comments","events_url":"https://api.github.com/repos/NixOS/nixpkgs/issues/5730/events","html_url":"https://github.com/NixOS/nixpkgs/issues/5730","id":54083846,"number":5730,"title":"Chromium not starting up since latest kernel update","user":{"login":"wizeman","id":168610,"avatar_url":"https://avatars.githubusercontent.com/u/168610?v=3","gravatar_id":"","url":"https://api.github.com/users/wizeman","html_url":"https://github.com/wizeman","followers_url":"https://api.github.com/users/wizeman/followers","following_url":"https://api.github.com/users/wizeman/following{/other_user}","gists_url":"https://api.github.com/users/wizeman/gists{/gist_id}","starred_url":"https://api.github.com/users/wizeman/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/wizeman/subscriptions","organizations_url":"https://api.github.com/users/wizeman/orgs","repos_url":"https://api.github.com/users/wizeman/repos","events_url":"https://api.github.com/users/wizeman/events{/privacy}","received_events_url":"https://api.github.com/users/wizeman/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-01-12T17:44:55Z","updated_at":"2015-01-12T17:44:55Z","closed_at":null,"body":"Since I updated from kernel `3.18.1` to `3.18.2`, chromium doesn't start up anymore.\r\n\r\nWhen starting chromium, I only see these messages in the console:\r\n\r\n```\r\nCan't write to gid_map.\r\nsetresgid: Invalid argument\r\nCould not drop privileges: Invalid argument\r\nRead on socketpair: Success\r\n```\r\nThen it appears to hang. There is a `chrome-sandbox` process in a zombie state at this point in time.\r\n\r\nI have straced the process, and it looks like the message `Could not drop privileges: Invalid argument` is related to this syscall:\r\n\r\n```\r\n[pid 19173] setresgid(65534, 65534, 65534) = -1 EINVAL (Invalid argument)\r\n```\r\n\r\nIn the kernel changelog, the only change from `3.18.1` -> `3.18.2` related to the above syscall seems to be:\r\n```\r\ncommit 335f060430dce42d7abc3a647f2d40de5a63c0cb\r\nAuthor: Eric W. Biederman <ebiederm@xmission.com>\r\nDate:   Fri Dec 5 18:26:30 2014 -0600\r\n\r\n    userns: Check euid no fsuid when establishing an unprivileged uid mapping\r\n    \r\n    commit 80dd00a23784b384ccea049bfb3f259d3f973b9d upstream.\r\n    \r\n    setresuid allows the euid to be set to any of uid, euid, suid, and\r\n    fsuid.  Therefor it is safe to allow an unprivileged user to map\r\n    their euid and use CAP_SETUID privileged with exactly that uid,\r\n    as no new credentials can be obtained.\r\n    \r\n    I can not find a combination of existing system calls that allows setting\r\n    uid, euid, suid, and fsuid from the fsuid making the previous use\r\n    of fsuid for allowing unprivileged mappings a bug.\r\n    \r\n    This is part of a fix for CVE-2014-8989.\r\n```\r\n\r\nSo at first glance, it appears that the fix for this CVE broke Chromium (or perhaps more specifically, the Chromium sandbox)?\r\n\r\nOn the other hand, I know we have some Nixpkgs-specific sandbox code in our version of Chromium, so I'm reporting the bug here before reporting it upstream."}}