7

After apt-get install chromium and running it on Debian 12,
ps alx | grep -e ^F -e ^5.*chromium returns:

F   UID     PID    PPID PRI  NI    VSZ   RSS WCHAN  STAT TTY        TIME COMMAND
5  1000 3452315 3452313  20   0 33884428 16712 do_sys S  ?          0:00 /usr/lib/chromium/chromium --type=zygote --crashpad-handler-pid=3452306 --enable-crash-reporter=,built on Debian 12.4, running on Debian 12.4 --change-stack-guard-on-fork=enable

This executed on LUbuntu 18 after apt-get install chromium-browser (which does
snap install chromium in its /var/lib/dpkg/info/chromium-browser.preinst):

F   UID     PID    PPID PRI  NI    VSZ   RSS WCHAN  STAT TTY        TIME COMMAND
5  1000  197953  197951  20   0 33909972 1228 do_sys S   ?          0:00 /snap/chromium/2729/usr/lib/chromium-browser/chrome --type=zygote --crashpad-handler-pid=197944 --enable-crash-reporter=,snap --change-stack-guard-on-fork=enable

where the flag F value 5 means used super-user privileges according to man ps.

Why does the Chromium browser need and get super-user privileges when installed by the regular package management and run by a non-privileged user ?

ChatGPT says this would be for installation or updating, but I don't believe that because I did installation using regular apt-get and updates would be done by unattended-upgrades on Debian or snapd on Ubuntu.

1 Answer 1

8

BTW :

where the flag F value 5 means used super-user privileges according to man ps.

Indeed but not only : 5 = 1 + 4

PROCESS FLAGS The sum of these values is displayed in the "F" column, which is provided by the flags output specifier:

           1    forked but didn't exec
           4    used super-user privileges

The forked but didn't exec flag confirming that the --type=zygote parameter set in the chrome process you list has actually been taken into account, successfully making it a zygote process.

In addition, please note the use of the past tense "used" meaning that the report does not reflect current status regarding capabilities that might well have been dropped right after process initialization. (It is considered as best practice for a process to drop privileges as soon as they are no longer needed)


For obvious security reasons, Chromium will resort to sandboxing.
Except in the case of now very old kernels, it will be using the User namespaces sandboxing technique. A zygote process is responsible for setting it up.

Security-wise, the Zygote is responsible for setting up and bookkeeping the namespace sandbox.

Even though this technique is based on unprivileged namespaces, the process responsible for setting it up actually needs the priviledged CAP_SYS_CHROOT capability but only until the sandbox is fully engaged.

So, in short : That process actually needs super-user capabilities in order to… enable everything running unpriviledged… ;-) and will just drop them as soon as the appropriate environment is set.

4
  • I did not say flag value 5 means nothing else than "used super-user privileges" so I still think my wording was correct, but I'm not sure because I'm not a native speaker of English. Do you think it is incorrect to say A means B if A actually means B and C ? How to say that in correct English if one doesn't want to mention C because that is irrelevant ?
    – Juergen
    Commented Jan 21 at 17:00
  • @Juergen : Ho well… not being a native speaker myself… I don't qualify for arguing about that. My intention was only to underline the fact that the forked but didn't exec flag is also set. (since it has its importance in this particular question). But anyway, I'm happy to remove my indeed questionable "This is not completely exact" statement.
    – MC68020
    Commented Jan 21 at 17:16
  • Seems I missd an important part: How is the fact that the process forked but did not exec important for this particular question ?
    – Juergen
    Commented Jan 21 at 23:07
  • @Juergen : I updated my answer with regards to the importance of the process forked but did not exec flag. In short : Chromium-browser spawns just many processes. This flag confirms the process you listed IS the one setting up the sandbox, incidentally justifying the explanation I provide (need for CAP_SYS_CHROOT)
    – MC68020
    Commented Jan 22 at 15:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .