Bug 2300183

Summary:	127.0.6533.72 koji build crashes occasionally and consistently when usernamespaces are disabled
Product:	[Fedora] Fedora	Reporter:	secureblue <secureblueadmin>
Component:	chromium	Assignee:	Than Ngo <than>
Status:	CLOSED ERRATA	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	urgent	Docs Contact:
Priority:	unspecified
Version:	40	CC:	dwalsh, lvrabec, mmalik, omosnacek, pkoncity, spotrh, suraj.ghimire7, than, vmojzis, yaneti, zpytela
Target Milestone:	---	Keywords:	Regression
Target Release:	---
Hardware:	x86_64
OS:	Linux
Whiteboard:
Fixed In Version:	chromium-127.0.6533.88-2.fc40 chromium-127.0.6533.88-2.fc39	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2024-08-03 01:50:13 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description secureblue 2024-07-27 06:42:52 UTC

I am testing using the f39 koji build of 127.0.6533.72 in an f39 VM, but I suspect the same bug will reproduce once the f40 build is done.

In short, entering text into some text boxes crashes the page, consistently. This only reproduces when chromium is using the SUID layer-1 sandbox, which occurs when the user.max_user_namespaces sysctl is set to 0.

I spun up an arch VM since they have a 127.0.6533.72 build out already as well, and could not reproduce the issue. I also installed Google Chrome Stable 127.0.6533.72 on the same F39 VM, and couldn't reproduce this issue. So this is something specific to Fedora's build.  

Reproducible: Always

Steps to Reproduce:
1. Install Fedora's chromium build 127.0.6533.72 from koji 
2. Disable usernamespaces by setting sysctl user.max_user_namespace = 0
3. Start chromium and ensure that the SUID sandbox is in use by checking the first row of the table at chrome://sandbox
4. Once you've confirmed the SUID sandbox is in use, go to old.reddit.com
5. Type a bunch of characters into the search bar including spaces
6. Observe the page crashes
Actual Results:  
The page crashes

Expected Results:  
The page should not have crashed

Comment 1 Than Ngo 2024-07-28 20:38:30 UTC

There's no change in chromium-127 from fedora side which could cause this regression.

This issue is gone if you set domain_can_mmap_files auf true.
  setsebool -P domain_can_mmap_files 1

It looks like a selinux issue!

Comment 2 secureblue 2024-07-28 21:30:32 UTC

@than While your fix does work, it doesn't explain the issue. 

1. I was able to reproduce this on F39, which has a different selinux-policy version than F40. So unless something simultaneously changed between both, selinux-policy isn't the underlying cause.

2. I am unable to reproduce with the official Google Chrome v127 rpm.


So, the issue is something that Fedora is doing, likely in conjunction with an upstream change. This issue should be moved back to chromium.

Comment 3 Than Ngo 2024-07-30 15:11:19 UTC

move back to chromium for further investigations

Comment 4 Fedora Update System 2024-08-01 20:26:44 UTC

FEDORA-2024-ff743391c3 (chromium-127.0.6533.88-2.fc39) has been submitted as an update to Fedora 39.
https://bodhi.fedoraproject.org/updates/FEDORA-2024-ff743391c3

Comment 5 Fedora Update System 2024-08-01 20:26:44 UTC

FEDORA-2024-3a1a0a664e (chromium-127.0.6533.88-2.fc40) has been submitted as an update to Fedora 40.
https://bodhi.fedoraproject.org/updates/FEDORA-2024-3a1a0a664e

Comment 6 Fedora Update System 2024-08-02 03:35:41 UTC

FEDORA-2024-ff743391c3 has been pushed to the Fedora 39 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2024-ff743391c3`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2024-ff743391c3

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 7 Fedora Update System 2024-08-02 03:40:22 UTC

FEDORA-2024-3a1a0a664e has been pushed to the Fedora 40 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2024-3a1a0a664e`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2024-3a1a0a664e

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 8 Fedora Update System 2024-08-03 01:50:13 UTC

FEDORA-2024-3a1a0a664e (chromium-127.0.6533.88-2.fc40) has been pushed to the Fedora 40 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 9 Fedora Update System 2024-08-03 02:29:02 UTC

FEDORA-2024-ff743391c3 (chromium-127.0.6533.88-2.fc39) has been pushed to the Fedora 39 stable repository.
If problem still persists, please make note of it in this bug report.