I’m trying to snap a web based game - actually a framework which will enable lots of games - and it uses nwjs as the runtime. I have this working in devmode, but when confined I get the following errors in dmesg:
I had a separate thread about process-control. However I think I have worked past that by replacing the nwjs runtime shipped with the application with the latest stable one from nwjs.io directly. In devmode the game launches fine, which it never did previously. But strictly I get those /dev/shm browser style failures which I didn’t get before.
I suggest using snappy-debug for pastes (the recent upload has a lot of nice improvements).
For dconf, you need to plugs the gsettings interface.
For the ‘ptrace’ syscall, this is not covered by process-control. ptrace can be used to break out of the seccomp sandbox in kernels < 4.8. However, I suspect this was triggered due to cascading failures (ie, if the shm accesses were allowed, we could allow it).
The shm denials are covered here: Shared memory in /dev/shm rewriting. Does using the snapcraft preload part resolve this? If it does, that is the ideal solution. If it doesn’t, we can consider updating the browser-support interface (it looks like nwjs uses the chromium content api under the hood).
This should have been: However, I suspect this was triggered due to cascading failures (ie, if the shm accesses were allowed, nwjs wouldn’t try to ptrace it).
As mentioned earlier, nwjs uses the chromium content api. Oxide was adjusted to account for this: https://git.launchpad.net/oxide/commit/?id=9bbf87e80b49e6abcc9419f142655a4ce2fc0638. Ideally nwjs would be updated to include a similar patch. Would they be amenable to that? (FTR, this would also be a nice improvement for electron apps).
As mentioned, we can hack up browser-support for this, but we should only do that as a last resort.
While I certainly could contact nwjs upstream, the problem for now is that most projects use old snapshots of nwjs rather than bleeding edge. It’s a fundamental component used on multiple platforms, so revving it requires a significant effort on their part, for little gain.
I’m also not exactly qualified to patch nwjs, would need to hunt down someone who could help with this.
Sure, but the ultimate goal is to get rid of transitional policy like browser-support and that can only happen if we approach upstreams and have them code for application isolation. Can you approach them?
Alternatively we could have a snapcraft part for nwjs that uses the snapcraft preload techniques for this one access. Did you try the snapcraft preload part?
In the meantime since you said most people use old releases, I’ve created a PR to adjust the browser-support interface.
Finally got around to re-testing this. Works a treat now with browser-support.This is a sample construct 3 game running as a strictly confined snap! Thanks @jdstrand!
Here you go. The ./game folder contains the usual game assets…
$ ls ./game
assets index.html js
name: gamename # short name for game, all lower case
version: '1.0' # arbitrary version number, can be any text
summary: Game Name # Short human readable name of the application
description: |
This is a game made with Phaser. # Multi-line 79 column wide description of game
grade: stable
confinement: strict # strictly confined application
# The apps section exposes a command to the running system
# The plugs allow access to the network, display, sound and input
# devices
apps:
gamename:
command: desktop-launch $SNAP/nw
plugs:
- network
- network-bind
- x11
- wayland
- desktop
- opengl
- pulseaudio
- browser-support
- screen-inhibit-control
- joystick
# 3 parts are needed
# metadata: directory containing a package.json used by nwjs to describe the application
# and set the initial screen resolution of the window
# nwjs: dumps the build of nwjs into the snap as-is. This was just downloaded from the nwjs
# website and is unchanged. Will get unpacked into the snap
# game: the actual unpacked game itself. Will also get dumped into the root of the snap
# along with nwjs.
parts:
metadata:
plugin: dump
source: metadata/
nwjs:
plugin: dump
source: https://dl.nwjs.io/v0.31.0/nwjs-v0.31.0-linux-x64.tar.gz
game:
plugin: dump
source: ./game
after:
- nwjs-support
- desktop-gtk3
I used desktop-qt5 instead of desktop-gtk3
and it worked fine used that because my app need some qt5 stuff too.