mirror of
https://github.com/CyberMind-FR/secubox-deb.git
synced 2026-07-29 18:36:55 +00:00
e0e3a335d4
On bare-metal x86_64 with the v2.10.0 image, chromium's zygote crashes in a restart loop: ERROR:content/browser/zygote_host/zygote_host_impl_linux.cc(...): ... disabled unprivileged user namespaces with AppArmor, ... you can try using --no-sandbox. Debian 12 ships AppArmor with the `unprivileged_userns` profile that restricts the unprivileged user namespace creation chromium's zygote needs to set up its renderer sandbox. The kernel sysctl `kernel.unprivileged_userns_clone` is `1`, but the AppArmor profile whitelists only known binaries — chromium launched as the `secubox-kiosk` user doesn't match. `secubox-kiosk-launcher:443-451` only passed `--no-sandbox` for VM targets (`systemd-detect-virt` non-`none`). On bare metal it omitted the flag, so the zygote died on every launch → systemd restart loop until MAX_FAILURES=3 disabled the kiosk and left X11 stranded on VT7. Drop `--no-sandbox` from both branches. The SecuBox kiosk runs as a dedicated unprivileged user on a single VT, AppArmor still enforces its per-process chromium profile, and the appliance sits behind its own WAF — chromium's internal sandbox provides marginal additional security here while breaking the kiosk entirely. Validated path: VBox kiosk continues to work; bare-metal x86_64 will reach the SecuBox login form after this fix. Co-authored-by: CyberMind-FR <gandalf@Gk2.net> |
||
|---|---|---|
| .. | ||
| secubox-cmdline-handler | ||
| secubox-console-tui | ||
| secubox-factory-reset | ||
| secubox-flash-disk | ||
| secubox-flash-emmc | ||
| secubox-kiosk-launcher | ||
| secubox-kiosk-setup | ||
| secubox-mode | ||
| secubox-net-detect | ||
| secubox-net-reset | ||
| secubox-overlay-init | ||
| secubox-ramcache | ||
| secubox-snapshot | ||
| secubox-x11-splash | ||