Chromium doesn't work after chmod [solved]

hrnick · Guru Joined: 31 Aug 2002 Posts: 425 Location: Sweden

Hi!

I've lately gone through the Gentoo Security Handbook in order to make my system less vulnerable. I followed the steps in the file permissions section and specifically the world or group writable section.

After changing the permissions (chmod o-w as specified in the guide) chromium and libreoffice couldn't start but I fixed libreoffice by restoring o+w to /var/tmp and I suspect there's something similar going on with chromium. This is the output I get when trying to start chromium:

Hu · Moderator Joined: 06 Mar 2007 Posts: 21631

I don't have a direct answer for you, but I do have a way you can try to solve this. Use strace (from dev-util/strace) to monitor all system calls made by the program(s). It will show you system call inputs and outputs, so you can see which paths the program tries to access, which of those succeed, and which fail. Look for paths that fail with "Permission denied" for requests that require write access. Cross-check that against paths that you likely would have changed the permissions on. If you're not sure, post here all the denied paths. Some denials may be legitimate if the program goes exploring to test the limits of its reach, so do not blindly grant access solely on the basis that it is currently denied.

hrnick · Guru Joined: 31 Aug 2002 Posts: 425 Location: Sweden

Thanks for your reply!

Here's the output from:
# strace chromium 2> trace.txt

And for comparison here's:
# sudo strace chromium --no-sandbox 2> trace2.txt (which works as expected so it's likely a permission related problem)

I tried setting o+w for files in /sys/fs since those files are opened right before the permission denied message but it didn't make a difference. Any suggestions on what to try next?

Thanks again!

Ant P. · Watchman Joined: 18 Apr 2009 Posts: 6920

Nothing in /sys should ever be chmod o+w. You have a really screwed up and potentially vulnerable system, first reboot to get the virtual filesystems back into a sane state, then we can go from there.

hrnick · Guru Joined: 31 Aug 2002 Posts: 425 Location: Sweden

Well that struck me as odd as well and I made sure to chmod o-w it right away after trying. I just wanted to see if it made a difference.

It turns out that chromium started just fine after rebooting the system. I was a little reluctant to do so right away in case anything else was broken after my chmod adventures. Anyway, this seems solved now.

Thanks for your help!