Reasons for extension runtime pausing

[Joel Dart]

Hi all, 

I develop and support a classroom management extension for schools. This provides teachers a realtime connection to student chromebooks during classtime. 

We have been tracking an issue where from the teacher end, the student machine is acting as if the chromebook is closed (the runtime has not been terminated, but our code has stopped executing). We've been fortunate that some teachers have been able to chat in to troubleshoot while students are co-located in the same classroom, but even so we have reached the limitations of our ability to reason about the situation.

From what we know, there would be three reasons why the runtime would be paused:

1. The machine is not running

2. The extension is paused in developer tools

3. The student is currently taking a locked quiz in Google Classroom

It's easy for us to work through 1 and 2 with teachers. Additionally, most schools have had to disable developer tools for various reasons (different sites will embed the "correct answer" of a quiz in the source code, etc) through GSuite. 

We've not found any way to verify that the machine has engaged Google Classroom (3). It's a very popular tool in classrooms, but it's not obvious if there are particular urls that we could have the teachers check or if there are any diagnostic pages we could have the teacher attempt to check that would show that this mode was engaged. 

The other gap is that we have a handful of teachers who are claiming that the student's  active window is on another domain than classroom when in this scenario. This implies there would have to be another scenario available, but again we've run out of tools for troubleshooting.

To be clear, our extension is using the background permission, so it is typically persistent. This is a very rare report from what I can tell. It's not a matter of the extension not being force-installed. It's not a matter of the extension being disabled. It's not a matter of the backing process of the extension being terminated. All the above go through the startup process in our extension. We have diagnostic logging we use to troubleshoot, and the breadcrumbs we leave behind look like it does when you pause the extension in dev tools. 

Interested if anyone has any future insight on how to troubleshoot this kind of issue.

Thanks,

Joel

[guest271314]

> We have been tracking an issue where from the teacher end, the student machine is acting as if the chromebook is closed (the runtime has not been terminated, but our code has stopped executing).

What is the code? 

How do you determine the code stopped running?

[wOxxOm]

Can a student use the built-in browser's Task Manager? If so, they would be able to trivially terminate the extension process.

[Hacker]

yes bro i am pause  thanks you so much your support me 

Dikirim dari ponsel cerdas Samsung Galaxy saya.

-------- Pesan asli --------

Dari: wOxxOm <wox...@gmail.com>

Tanggal: 27/09/20 21:41 (GMT+07:00)

Ke: Chromium Extensions <chromium-...@chromium.org>

Cc: "dart...@gmail.com" <dart...@gmail.com>

Subjek: [crx] Re: Reasons for extension runtime pausing

--
You received this message because you are subscribed to the Google Groups "Chromium Extensions" group.
To unsubscribe from this group and stop receiving emails from it, send an email to chromium-extens...@chromium.org.
To view this discussion on the web visit https://groups.google.com/a/chromium.org/d/msgid/chromium-extensions/e323413a-106c-4d4f-857d-291c93c7497dn%40chromium.org.

[Joel Dart]

>What is the code? 

>How do you determine the code stopped running?

We write diagnostic log statements to local async storage. Since we're a realtime application, there are regular breadcrumbs. I was suspicious that the logging was unreliable, so I created a secondary data structure which keeps track of when we're online. I use a setTimeout(runTimer, 60000); and in runTimer, it checks Date.now() against the last timeframe (simplified code to remove some other information)

var now = Date.now();
if (now > collector.lastTime + 60000*1.5){

    var then = lastTime + 60000;
    collector.activities.push({ time: then, status:"offline"});

    collector.activities.push({ time: now, status:"online"});

} else{

    collector.activities.push({ time: now, status:"online"});

}
collector.lastTime = now;
setTimeout(runTimer, 60000);

This then can be saved out in a semi-atomic unit. This code represents the laptop sleeping properly, but doesn't represent the process being terminated (by design). The results of this code showed the same thing that the diagnostic logs showed. The teacher claimed that the student machine was on during that timeframe. There's always room for users being mistaken, but if there were other ways to troubleshoot to give to the teacher, that would be best. 

>Can a student use the built-in browser's Task Manager? If so, they would be able to trivially

Correct, but in a force-installed application this immediately starts up automatically. In this case, our logs show that is not the current scenario. That would get logged into a different log file (this all occurs in one) and when starting up, it would log out our app start sequence which is missing (the log statements go from 12:34:44 to 13:33:27 between the two lines). Additionally my data structure above gets reinitialized on startup. This was not the case. 

[wOxxOm]

You're using Date.now() which can probably shift by more than 30 seconds due to the automatic clock adjustment. The size of the shift is unusually big though.

If some of your content scripts use setTimeout or setInterval or requestAnimationFrame, beware that the page can clear them because all these things are part of DOM per the specification so they're not isolated in the content script world. Assuming devtools is disabled, a student might be still able to find a way to inject a script on the current web page e.g. using an XSS vulnerability on this page or some extension like Tampermonkey that allows to run user js.

[Joel Dart]

guest - thanks for the thoughts. We've got the presence problem solved already through the realtime connection we use (abstracting over websockets, server sent events, and longpolling). And yes, programmatically we cannot determine why the runtime is paused, but we can increase our list of "reasonable possibilities" and see if we can get the user to run a test when in the moment to narrow down the possibilities. From the report, I am not really suspecting foul play here. I am interested in determining if there are any additional diagnostic pages or scenarios that I can use to reason about the issue. 

wOxxOm - is there any more information about automatic clock adjustment? I thought chrome os would only sync the clock on login. I have a vm that regularly cannot connect to ssl when I restore a snapshot, and that was the conclusion I had from my research on it at the time. Just wondering what superstitions I've created haha. 

Additionally, the logs indicate we reconnected immediately at the 13:33 mark. If that was the case, there would have been no gaps in the presence information that the teacher was seeing (which was the source of the issue being reported - they were showing up as disconnected even though the student machine was up and working on an assignment). 

The content script warning is an interesting callout, and I appreciate it. I also really enjoy the current web page being an "attack vector" to consider. We don't use content scripts. All this code is running in the background page. I've lived that 3rd party code life long enough to want to avoid being the problem if I can. 

[Simeon Vincent]

Joel,

Two resources that you might want to look into are chrome://policy/, which Contains information about the enterprise policies apply to this device, and chrome://extensions-internals/, which contains more information about the extensions installed in the users device.

Please note that both of these resources expose sensitive information about the user. You might want to work with the institutions' IT departments to make sure that sharing collecting this data from their users does not violate any of their internal policies or to sanitize these pages.

Cheers,

Simeon - @dotproto

Developer Advocate for Chrome Extensions