fix(desktop): configure Linux Electron sandbox helper - #37691
Merged
Conversation
Electron's chrome-sandbox helper must be root:root 4755 on Linux or the sandboxed renderer aborts before the desktop app starts. The existing installer only searched for macOS .app bundles, so a successful Linux build was reported as missing. Changes: - Add _desktop_linux_sandbox_fixup() to hermes_cli/main.py, called before launching a packaged desktop app on Linux. - Use lstat() + S_ISREG check to reject symlinks — chown/chmod on a symlink target would set SUID on an arbitrary path. - Update install.sh to recognize Linux unpacked artifacts and configure chrome-sandbox with proper error handling (the original PR silently ignored chown/chmod failures). - Add regression tests: normal fixup flow, symlink rejection, and already-configured skip path. Closes #37529 (rebased, merge conflicts resolved, copilot review feedback addressed).
Contributor
🔎 Lint report:
|
|
Thank you @ethernet8023, I appreciate the review and proper implementation of this! My fix made it work on my machine but you likely have a more experienced eye for this! Excited for Hermes Desktop app! |
alt-glitch
added
type/bug
Contributor
|
@ethernet8023 confirmed working, good to merge. cc @alt-glitch |
simpolism
approved these changes
Jun 2, 2026
1 task
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Electron's
chrome-sandboxhelper must beroot:root 4755on Linux or the sandboxed renderer aborts before the desktop app starts. The existing installer only searched for macOS.appbundles, so a successful Linux build was reported as missing.This is a salvage of #37529 (by @Jgracier) — rebased onto current
mainto resolve merge conflicts, and addresses the two issues raised by Copilot's review:stat()which follows symlinks;chown/chmodon a symlink target would set SUID on an arbitrary path. This version useslstat()+S_ISREG()to reject non-regular-file sandbox helpers.chown/chmodfailures. This version returns non-zero on failure.What changed
hermes_cli/main.py: Add_desktop_linux_sandbox_fixup()usinglstat()+S_ISREG()to reject symlinks beforesudo chown/sudo chmod. Wired intocmd_gui()before launch.scripts/install.sh: Recognize Linux unpacked artifacts (linux-unpacked/Hermesorhermes). Configurechrome-sandboxwith! -Lsymlink guard and proper error handling onchown/chmodfailure.tests/hermes_cli/test_gui_command.py: Three new tests:test_gui_linux_configures_sandbox_before_launch— verifiessudo chown/sudo chmodare called before launchtest_gui_linux_rejects_symlink_sandbox— verifies symlinkedchrome-sandboxis rejected without callingsudotest_gui_linux_skips_fixup_when_already_configured— verifies no-op when sandbox is already root:root 4755Verification
bash -n scripts/install.sh✅python -m pytest tests/hermes_cli/test_gui_command.py -q— 19 passed ✅python -m pytest tests/test_install_sh_*.py -q— 10 passed ✅Closes #37529