Allow electron renderers to be run inside chromium sandbox

[tarruda]

Progress on supporting sandbox in electron started in #6919, but the remaining work will be done by future PRs. This issue will be used to track progress on all relevant tasks.

• Add sandbox option to webPreferences of BrowserWindow. (Add sandbox option and support native window.open #6919)
• Support chromium native window.open API in sandboxed renderers. (Add sandbox option and support native window.open #6919)
• Extract code that is not specific to node.js from AtomRendererClient into a base class that is also shared by AtomSandboxedRendererClient.
• Patch libchromiumcontent to allow reuse of code that determines which navigations should spawn a new renderer. More details here
• Add sandbox option to <webview> tag.
• Expose node.js builtin modules via IPC to sandboxed renderers.
• Reuse most javascript code under lib/renderer/ and lib/common. The goal is to support the full electron API in sandboxed renderers.
• Add documentation

[zcbenz]

This is needed by a few special projects and as far as I know some organizations are already doing this in their own forks.

But moving Electron's API stack from Node is too ambitious, a more practical way is to provide a very small set of APIs under sandbox to allow communicating with the main process.

[tarruda]

But moving Electron's API stack from Node is too ambitious, a more practical way is to provide a very small set of APIs under sandbox to allow communicating with the main process.

Do you mean by providing an implementation of ipcRenderer that doesn't rely on node.js, and enabling this implementation in a new mode that completely disables node.js integration(and enables the sandbox)?

I think this would be a good start, but what would be even better is to completely decouple electron's renderer API from node.js, to make it fully useable not only with nodeIntegration enabled but also in a sandboxed renderer. In other words, nodeIntegration would simply add node.js APIs to the renderer, but it would not be required to access electron's APIs.

In any case, having a simple implementation of ipcRenderer without node.js would certainly help me get to what I'm trying to achieve here.

[jprichardson]

@sindresorhus will you elaborate on your thumbs down? I'm curious to know your perspective here.

[ThomasMoutel]

Hi @tarruda I'm willing to get the crash-reporter working in sandboxed renderers.
It is not working currently, probably by design, no?
Is this something you've already looked into and/or planned to do in the near future?

[tarruda]

It is not working currently, probably by design, no?

Not by design, I simply left this for later(Feel free to take this task)

[anaisbetts]

I think this would be a good start, but what would be even better is to completely decouple electron's renderer API from node.js, to make it fully useable not only with nodeIntegration enabled but also in a sandboxed renderer. In other words, nodeIntegration would simply add node.js APIs to the renderer, but it would not be required to access electron's APIs.

I think that this will create a pretty massive maintenance burden, I'd rather enable simple IPC and leave it at that