setuid_sandbox_host.cc(163)] The SUID sandbox helper binary was found

[fredlubrano]

Describe the bug
After the update to version 1.11.0, there are permission issues with chrome-sandbox

To Reproduce
Steps to reproduce the behavior:

sudo apt install ./Downloads/teams-for-linux_1.11.0_amd64.deb

Expected behavior
~ teams-for-linux
[83647:0929/152327.695500:FATAL:setuid_sandbox_host.cc(163)] The SUID sandbox helper binary was found, but is not configured correctly. Rather than run without sandboxing I'm aborting now. You need to make sure that /opt/teams-for-linux/chrome-sandbox is owned by root and has mode 4755.
[1] 83647 trace trap (core dumped) teams-for-linux

Screenshots
If applicable, add screenshots to help explain your problem.

Desktop (please complete the following information):

• OS: Ubuntu 24.04.1
• Installation package deb
• Version 1.11.0

Debug
teams-for-linux --webDebug --logConfig='{}'
[84087:0929/153335.703258:FATAL:setuid_sandbox_host.cc(163)] The SUID sandbox helper binary was found, but is not configured correctly. Rather than run without sandboxing I'm aborting now. You need to make sure that /opt/teams-for-linux/chrome-sandbox is owned by root and has mode 4755.
[1] 84087 trace trap (core dumped) teams-for-linux --webDebug --logConfig='{}'

IMPORTANT: Ensure that you mask any sensitive information before posting the output.

Additional context
Resolv
sudo chown root:root /opt/teams-for-linux/chrome-sandbox
sudo chmod 4755 /opt/teams-for-linux/chrome-sandbox

[fredlubrano]

It also works with teams-for-linux --no-sandbox

[damien-louis]

Same issue after update to 1.11.0

[ondrej-simon]

Thank you, @fredlubrano , I modified my launcher script by appending the --no-sandbox option, so that I can still launch the application from Desktop icon:

cat /usr/share/applications/teams-for-linux.desktop

[Desktop Entry]
Name=Teams for Linux
Exec=/opt/teams-for-linux/teams-for-linux --no-sandbox %U
Terminal=false
Type=Application
Icon=teams-for-linux
StartupWMClass=teams-for-linux
Comment=Unofficial Microsoft Teams client for Linux using Electron. It uses the Web App and wraps it as a standalone application using Electron.
MimeType=x-scheme-handler/msteams;
Categories=Chat;Network;Office;

[huxxer]

Got the same issue after update to 1.11.0

[SergeyKhrystenko]

Got the same issue after update to 1.11.0

[IsmaelMartinez]

This seems to be a electron issue electron/electron#42510

There are a few workarounds in electron-userland/electron-builder#5371 (comment) and other pages, but I will see if I can understand the issue better rather than just apply the "no-sandbox" for all.

[moether]

Seems to be a pure Ubuntu 24.04 issue where apparmor is rejecting the use of unprivileged user namespaces without a corresponding application configuration in /etc/apparmor.d/ which are used by the sandboxing. Details described here: https://ubuntu.com/blog/whats-new-in-security-for-ubuntu-24-04-lts

Sep 30 09:55:49 kernel: audit: type=1400 audit(1727682949.856:664): apparmor="AUDIT" operation="userns_create" class="namespace" info="Userns create - transitioning profile" profile="unconfined" pid=13074 comm="teams-for-linux" requested="userns_create" target="unprivileged_userns"

Sep 30 09:55:49 kernel: audit: type=1400 audit(1727682949.857:665): apparmor="DENIED" operation="capable" class="cap" profile="unprivileged_userns" pid=13079 comm="teams-for-linux" capability=21 capname="sys_admin"

This comment describes how to (temporarily) disable the restriction electron/electron#42510 (comment)

But the correct solution probably is to deploy such an apparmor file for Ubuntu 24.04 and up which explicitly allows for unrestricted user NS for the teams-for-linux binary.

[KPS-MWT]

I have attached a working AppArmor profile file, to be copied to /etc/apparmor.d/teams-for-linux (I don't have my dev system with me ATM). Seems to be better than running without sandbox.

teams-for-linux.txt

[IsmaelMartinez]

Reading further, this seems to be an issue with electron-builder, and maybe also electron.

electron-userland/electron-builder#5721
electron-userland/electron-builder#8440
electron/electron#42510

I will keep an eye and see when the fix comes available, but the workaround might be needed for a while.

It does affect pretty much all electron apps, so we I do hope a fix appears soon(ish)

[moether]

I have attached a working AppArmor profile file, to be copied to /etc/apparmor.d/teams-for-linux (I don't have my dev system with me ATM). Seems to be better than running without sandbox.

teams-for-linux.txt

Works like a charm. The profile allows user name spaces for the executable /opt/teams-for-linux/teams-for-linux. teams-for-linux starts with sandboxing enabled.

1. copy content of teams-for-linux.txt to /etc/apparmor.d/teams-for-linux
2. reload AppArmor: sudo systemctl reload apparmor.service
3. Enjoy

[NaimadTheOne]

@KPS-MWT, @moether and @IsmaelMartinez thank you for the quick resolution of this issue.
I am proud of this community.

[burneystarke]

I ran chmod 4755 /opt/teams-for-linux/chrome-sandbox and I am all set.
Before:

After: