Fix not being able to run tests on Electron in Ubuntu 24.04 pipelines #8914

GytisCepk · 2026-01-20T14:12:21Z

Due to changes in Ubuntu 24.04, sandboxed Electron does not work.

Alternative solution would be to make sure that correct profile is assign to necessary files, but it may complicate our pipelines even more.

It would be great, if someone more familiar with Linux permissions model, would take a look at this.

aruniverse · 2026-01-20T14:14:05Z

@markschlosseratbentley iirc youre a linux user, can you take a pass?

Copilot

Pull request overview

This PR resolves Electron test failures on Ubuntu 24.04 by implementing a workaround for the platform's new unprivileged user namespace restrictions. The changes add a script to configure chrome-sandbox permissions and update CI pipeline configurations to use ubuntu-latest instead of pinning to ubuntu-22.04.

Changes:

Added a new script step in the integration test template to locate and configure chrome-sandbox permissions with setuid bit
Updated three Azure pipeline configuration files to use ubuntu-latest instead of ubuntu-22.04
Removed comments explaining the previous workaround of pinning to ubuntu-22.04

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.

File	Description
common/config/azure-pipelines/templates/integration-test-steps.yaml	Adds script to fix Electron chrome-sandbox permissions on Linux
common/config/azure-pipelines/integration-validation.yaml	Updates Linux test matrix entries to use ubuntu-latest
common/config/azure-pipelines/integration-pr-validation.yaml	Updates PR validation job to use ubuntu-latest

common/config/azure-pipelines/templates/integration-test-steps.yaml

markschlosseratbentley · 2026-01-20T14:23:39Z

@markschlosseratbentley iirc youre a linux user, can you take a pass?

Unfortunately, I no longer have a Linux partition. IIRC, @pmconne does.

pmconne · 2026-01-20T14:35:13Z

@aruniverse how do you want it tested - just try to run the core-full-stack integration tests? Or presumably I need to run the actual pipeline?

I presume this is the same or similar issue that I experience whenever trying to run display-test-app?

j2 display-test-app: pmc/anchor-line-patterns 09:31:26 ~/c/j2/s/itwinjs/test-apps/display-test-app 0> npm run start

> display-test-app@1.8.0 start
> cross-env NODE_ENV=development run-p start:webserver start:electron


> display-test-app@1.8.0 start:webserver
> cross-env NODE_ENV=development vite


> display-test-app@1.8.0 start:electron
> electron ./lib/backend/DtaElectronMain.js --inspect --remote-debugging-port=9223

[26868:0120/093133.752231:FATAL:sandbox/linux/suid/client/setuid_sandbox_host.cc:166] The SUID sandbox helper binary was found, but is not configured correctly. Rather than run without sandboxing I'm aborting now. You need to make sure that /home/paul/c/j2/s/itwinjs/common/temp/node_modules/.pnpm/electron@39.0.0/node_modules/electron/dist/chrome-sandbox is owned by root and has mode 4755.
/home/paul/c/j2/s/itwinjs/common/temp/node_modules/.pnpm/electron@39.0.0/node_modules/electron/dist/electron exited with signal SIGTRAP
ERROR: "start:electron" exited with 1.

EDIT: yes it's the same error (can we fix the test-apps too or at least document it for other people trying to run them?)

….yaml Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

GytisCepk · 2026-01-20T15:27:47Z

@aruniverse how do you want it tested - just try to run the core-full-stack integration tests? Or presumably I need to run the actual pipeline?

Pipeline is passing. The question is more whether solution is sound.

EDIT: yes it's the same error (can we fix the test-apps too or at least document it for other people trying to run them?)

From what I gather, there is multiple ways to solve this and it's really depends on user's Linux distribution which solution is the best. For that reason, I think, it's up to the user to make sure his environment does not block running sandboxed Electron.

That being said, Ubuntu 24.04 might be common enough case to warrant a note in display-test-app's README.md

MichaelSwigerAtBentley · 2026-01-20T17:07:11Z

common/config/azure-pipelines/templates/integration-test-steps.yaml

+      SANDBOX_PATH=$(find $PWD/common/temp/node_modules/.pnpm -path "*/electron@*/node_modules/electron/dist/chrome-sandbox" 2>/dev/null | head -n 1)
+      if [ -f "$SANDBOX_PATH" ]; then
+        sudo chown root:root "$SANDBOX_PATH"
+        sudo chmod 4755 "$SANDBOX_PATH"


Can you add a comment about what this chmod enables? This is setting execute (5 - read+execute) for all users, correct?

If it is decided to leave this, then a comment explaining what it does and why it is acceptable is definitely required. The 4 at the beginning means that chrome-sandbox will execute using the user ID of the file's owner. The file was just changed to be owned by root, so what this is doing is having chrome-sandbox execute as root, with full root privileges. That seems to be the intended fix, but I find it to be very dangerous.

MichaelSwigerAtBentley · 2026-01-20T17:08:02Z

common/config/azure-pipelines/integration-validation.yaml

      matrix:
        Linux_node_20_x:
-          imageName: ubuntu-22.04 # ubuntu-latest is 24.04, and breaks tests using sandbox
+          imageName: ubuntu-latest


Are we sure we want to swap to latest and not a fixed 24.x? What if latest breaks us again in the future

tcobbs-bentley · 2026-01-20T17:05:45Z

common/config/azure-pipelines/templates/integration-test-steps.yaml

+      SANDBOX_PATH=$(find $PWD/common/temp/node_modules/.pnpm -path "*/electron@*/node_modules/electron/dist/chrome-sandbox" 2>/dev/null | head -n 1)
+      if [ -f "$SANDBOX_PATH" ]; then
+        sudo chown root:root "$SANDBOX_PATH"
+        sudo chmod 4755 "$SANDBOX_PATH"


I think running chrome-sandbox as root is really bad idea. I would say that if this is the recommended solution, then the people doing the recommending are not very trustworthy.

(But I guess it's possible that I'm missing something, and chrome-sandbox is somehow super safe to run as root. I'm dubious about that, though.)

This may be a safer fix:

https://gist.github.com/0xdeadbad/5ef3a38c8cf6efc264d9a6f11f50e5b8

Note: the fix fix above is for a different program, but I think it can be adapted to work with Electron/chrome-sandbox.

Also, the following command probably fixes the problem without giving root privileges to the chrome-sandbox process:

sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0

I believe that this puts the security back to the way it was before 24.04. That's definitely not ideal, but may be better than the current fix. Changing the 0 at the end to 1 restores the original settings.

tcobbs-bentley · 2026-01-20T17:13:18Z

common/config/azure-pipelines/templates/integration-test-steps.yaml

+      SANDBOX_PATH=$(find $PWD/common/temp/node_modules/.pnpm -path "*/electron@*/node_modules/electron/dist/chrome-sandbox" 2>/dev/null | head -n 1)
+      if [ -f "$SANDBOX_PATH" ]; then
+        sudo chown root:root "$SANDBOX_PATH"
+        sudo chmod 4755 "$SANDBOX_PATH"


If it is decided to leave this, then a comment explaining what it does and why it is acceptable is definitely required. The 4 at the beginning means that chrome-sandbox will execute using the user ID of the file's owner. The file was just changed to be owned by root, so what this is doing is having chrome-sandbox execute as root, with full root privileges. That seems to be the intended fix, but I find it to be very dangerous.

GytisCepk added 5 commits January 20, 2026 10:57

Use ubuntu-latest in PR validation pipeline

145571b

Try 'unconfined' profile

4017514

Try changing permissions for chrome-sandbox

0621976

Restore other tests

f975fa5

Clean up

16ef34b

GytisCepk requested review from DanRod1999, aruniverse and wgoehrig as code owners January 20, 2026 14:12

aruniverse requested a review from Copilot January 20, 2026 14:13

aruniverse requested a review from markschlosseratbentley January 20, 2026 14:14

Copilot AI reviewed Jan 20, 2026

View reviewed changes

common/config/azure-pipelines/templates/integration-test-steps.yaml Outdated Show resolved Hide resolved

common/config/azure-pipelines/templates/integration-test-steps.yaml Show resolved Hide resolved

common/config/azure-pipelines/templates/integration-test-steps.yaml Show resolved Hide resolved

Update common/config/azure-pipelines/templates/integration-test-steps…

1d9f7fc

….yaml Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

pmconne approved these changes Jan 20, 2026

View reviewed changes

MichaelSwigerAtBentley reviewed Jan 20, 2026

View reviewed changes

tcobbs-bentley reviewed Jan 20, 2026

View reviewed changes

Fix not being able to run tests on Electron in Ubuntu 24.04 pipelines #8914

Are you sure you want to change the base?

Fix not being able to run tests on Electron in Ubuntu 24.04 pipelines #8914

Conversation

GytisCepk commented Jan 20, 2026

Uh oh!

aruniverse commented Jan 20, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

markschlosseratbentley commented Jan 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

pmconne commented Jan 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

GytisCepk commented Jan 20, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

markschlosseratbentley commented Jan 20, 2026 •

edited

Loading

pmconne commented Jan 20, 2026 •

edited

Loading