Need inputs on using chromium zygote

[vishnu vardhan reddy.p Reddy]

I need to start/run linux chromium zygote with a different entry point than the actual exe which started the browser app, for a valid reason. I was able to do it but facing issues enabling sandbox.

EnabledLayerOneSandbox() asserts at multiple places that the process IsSingleThreaded(). In my case it is not and I might not be able to get rid of other threads. Any options to make this work?  Appreciate any inputs, thanks

https://source.chromium.org/chromium/chromium/src/+/main:content/zygote/zygote_main_linux.cc;drc=72186360334350c90b9b94515b3c82bea25e27ff;l=151?q=ZygoteMain&ss=chromium%2Fchromium%2Fsrc

[re:fi.64]

(Obligatory "I am not a Chromium developer" here.)

AFAIK it's not really possible to safely use the namespace sandbox at
all with multiple threads, for various reasons:

- `unshare(CLONE_NEWUSER)`, used to enter the namespace sandbox, fails
with multiple threads.
- `capset()`, used by the namespace sandbox to drop capabilities, only
drops them for the current thread (attempting to work around it for
multiple threads is inherently racy without some awful workarounds)
- The BPF sandbox seems to generally assume a single thread, but I'm
not aware of the reasons why

Your best bet would just be to try and spawn any threads *after* the
sandbox is entered, or kill any other threads if/when they're no
longer needed.

> --
> --
> Chromium Developers mailing list: chromi...@chromium.org
> View archives, change email options, or unsubscribe:
> http://groups.google.com/a/chromium.org/group/chromium-dev
> ---
> You received this message because you are subscribed to the Google Groups "Chromium-dev" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to chromium-dev...@chromium.org.
> To view this discussion on the web visit https://groups.google.com/a/chromium.org/d/msgid/chromium-dev/da32a147-3223-49ab-8efc-1babf5f174cdn%40chromium.org.

[vishnu vardhan reddy.p Reddy]

BPF sandboxing(layer2) is not part of the zygote process and I think it is part of renderer process. Hope this is not dependent on renderer process being single threaded. At least thats what I see from code.

If not able to use chromium zygote for layer1 sandboxing due to non-single threaded reason, are there any options to achieve the layer1 sandboxing.

Thanks,

Vishnu