Repository navigation
Linux Browser launcher must not need passwordless sudo #165
Description
Part of #87.
Current goal: installer-owned Linux Browser host setup
The ordinary installer offers one explained root step for KVM access and the Browser network device/firewall. It shows the removal command. Runtime, providers and Browser launch remain ordinary-user processes and never call sudo. #90 owns actual Jetson proof; broader x86/reboot qualification stays under #293.
Current checkpoint: source implemented; installed gates open
PR #307 is merged and installer integration is implemented: it admits the helper, explains its changes, asks for the one-time root step, prints removal and resumes ordinary setup. Current source retains KVM/vhost-vsock access, scoped ACL/udev/filter setup and restoration. Runtime launches use ordinary-user authority. Installer and network fixtures pass in the source results linked from #217. Installed setuid/capability scan and sudo-free session proof run with the separate Linux x86 service journey. Actual Jetson and reboot proof remain open; Linux ARM64 is hidden until an enabled release.
The Linux fixture now passes actual host setup, ordinary-user check and removal: four owned TAPs/filter chains and setup records are absent after removal, and the recorded KVM/vhost-vsock user ACLs are restored. Setup was then restored for the service journey. This binds the helper source to 619b641df; it is a host-step proof, while installed Runtime sudo-free/setuid/capability and Jetson/reboot gates remain open.
Current installer check — 3 November 2026
The #90 source snapshot 3a8f41c62 invokes helper setup with --user in both the interactive and printed manual paths. The helper defaults to kernel-vsock; the tested Jetson needs the admitted confined userspace-vsock backend. Existing host preparation can hide this mismatch. Prove ordinary install on an empty eligible Jetson host, including explicit transport selection, matching root/boot receipts, unprivileged operation and removal. On kernel-vsock hosts, preserve the existing approved device path. #406 owns the signed-byte check at the privileged boundary. Main owns the #90 release lane.
Next step
Anders runs the root step on the Jetson test install (#90) once disk is freed. Codex proves the installed ordinary-user journey and removal/resource result on #90. No further installer source connection is pending.
Release checks
- The Runtime, its providers and Browser networking never call sudo. The installer may create the Browser network device and firewall rules once, as root, after saying so and asking. At run time no binary is setuid or has file capabilities, and nothing calls sudo. Test: a scan of the installed files finds no setuid or capability binary, and a Browser session runs with sudo removed from PATH.
- Ordinary installation offers explicit one-time privileged Browser host setup, identifies its effects and supports removal. User-session Runtime, providers and launches operate without sudo, setuid binaries or file capabilities.
The remaining original x86 launch/reboot/installed-files and seed-hardening criteria stay open in the prior record and #174/#183/#293. One lead (Codex) and at most one read-only reviewer. Fast local checks per change, one CI run per coherent batch, failed-job reruns only. OMP integrates the reviewed branch, performs cross-family review and publishes the release. Runtime owns signed artifact admission, configuration and lifecycle; Engine owns website execution and rendering; Exit owns authorized website networking; Carrier carries delivery below Runtime authority.
Activity
andersalm commentedon Oct 1, 2026
Part of #173 (isolation plan).
andersalm commentedon Oct 8, 2026
Historical scope before the 8 October 0.8.0 finish-line instruction. The current goal, checkpoint and next step are in the issue body.
Previous record
Part of #173 (isolation plan); related: #87, #83.
Status (6 Oct): PR #250 merged. The launcher no longer calls sudo; a one-time root step (
scripts/browser-vm-linux-network.py, asks first, with aremovestep) creates the TAP devices, firewall rules and KVM access, and a systemd unit and udev rule restore them after reboot. Unit tests pass in CI. Not yet proven: a real launch and cleanup without sudo on installed Linux x86-64, a reboot, and the installed-files scan; the installer does not run the setup step yet.Before #250 the launcher set up the guest network with
sudo -n ip ...andsudo -n iptables ..., so it needed the account that runs the Runtime to have passwordless sudo. On the public seed that account hasNOPASSWD: ALLand the Docker group, and the Runtime with all its native providers runs there unconfined (no NoNewPrivileges, seccomp or AppArmor;systemd-analyze security9.2). A code-execution bug in any internet-facing part of the public Home then gives root on the server in one more step, and the passwordless sudo also blocks the obvious systemd hardening (NoNewPrivileges=yes).Jetson has no Browser engine VM today and is out of scope here.
Done means
Browser mission Linux host contribution (#283)
This issue retains its Linux x86-64 scope and supplies B01/B02/B07 host evidence to #283. PR #250 source tests are a prerequisite result; installed acceptance remains open.
Coordinate signed component delivery with #217/#89. #90 and #283 own actual Jetson/ARM64 and other role decisions; this issue does not infer their local Engine support from x86 source presence.
Browser plan reconciliation — 2026-10-08
#288 consumes approved one-time Linux host preparation/removal, while #293 consumes this issue's installed x86 KVM/reboot/cleanup receipt. PR #250's source result remains accepted at its scope. Actual Jetson/ARM64 host preparation belongs #90; #292 owns the full advertised profile binding. Use the existing authorized Mac/Jetson targets and optional existing Namespace only; a missing suitable x86 KVM host leaves that installed row pending.
andersalm commentedon Oct 13, 2026
Postponed to 0.8.1: Browser on Linux follows #349.
Revise S1 design per review: minimal, three components, two questions