After installation on Ubuntu, it cannot be started normally due to a permission problem

[flyratlove]

Preflight Checklist

• I agree to follow the Code of Conduct that this project adheres to.
• I have searched the issue tracker for a feature request that matches the one I want to file, without success.

1. On Ubuntu, I downloaded the amd64.deb from GitHub and completed the installation without any issues.
2. Clicking the drawio icon did not start the application.
3. When trying to start drawio by typing it in the terminal, it prompted that the permissions for /opt/drawio/chrome-sandbox were incorrect and needed to be set to 4755.
4. Following the prompt, I executed sudo chmod 4755 /opt/drawio/chrome-sandbox in the terminal.
5. Subsequently, drawio started successfully.

From the above steps, it can be confirmed that there was an issue with the permissions configuration of chrome-sandbox in the drawio amd64.deb package. I am not sure if this issue is specific to Ubuntu 24.10 or if it occurs on all Linux distributions. Regardless, after the above operation, drawio is now working properly.

draw.io version (In the Help->About menu of the draw.io editor):

• draw.io version 25.0.2/26.0.3/26.0.4

Desktop (please complete the following information):

• OS: Ubuntu24.10

[grf692]

FYI it also affects KDE neon 6.2 (which based on Ubuntu 24.04).

[ee5cd7d5d]

It affects the appimage as well. I am using Ubuntu 24.04, and my error message is:

[27832:1216/103416.320669:FATAL:setuid_sandbox_host.cc(163)] The SUID sandbox helper binary was found, but is not configured correctly. Rather than run without sandboxing I'm aborting now. You need to make sure that /tmp/.mount_drawio8DR1lB/chrome-sandbox is owned by root and has mode 4755.
[1]    27832 trace trap (core dumped)  ./drawio-x86_64-25.0.2.AppImage
[1216/103416.439863:ERROR:icu_util.cc(223)] Invalid file descriptor to ICU data received.

[xcfstudio]

我使用Ubuntu系统，KDE桌面环境，遇到同样问题。在控制台输入sudo chmod 4755 /opt/drawio/chrome-sandbox即可解决问题。

I am using Ubuntu system and KDE desktop environment, and I am experiencing the same problem. To solve the problem, enter sudo chmod 4755/opt/rawio/chrome sandbox in the console.

[krichter722]

Reoccurring problem since 2019, the downloadable packages and images just don't work.

#158
#150
and many more.

Apparently devs consider it a "fix" if users chmod the directory in question. Therefore the issue arises again and again over many years. I guess for the AppImage which uses a temporary directory there's no fix and it's conceptually unusable.

If you find and understand the message you can work around it with chmod , however I think you shouldn't because setuid comes with a ton of implications and most users won't know what they're doing and risking. And it's simply against any common sense of security to leak unnecessary permissions by design.

[davidjgraph]

We don't consider it anything, drop the attitude. We just don't run linux boxes and are bored of 90% of OS issues being linux, it's a pile of shit to develop for.

[lucaaamaral]

I just wanted to reinforce here that I'm facing the same issue with the .deb installer. It also happens after an update ran through the application.
It is just a small problem on a great application.

[complib2891]

seems to me this application is the perfect target for hacker, since the sandbox is own by root, thus when running the desktop app, these security holes are candidates:

XSS since it's javascript based, thus can run every commands on this system when this app is open. so hackers just need to implement supply-chain-attack behind the scene by targeting vulnerable packages, then you can take over developers machines from all over the world, it's ripe for the taking. hohoho~

I hope hackers and security researchers can pitch in on this.. as I'm not and I'm worried. I'm sorry as I'm one of 90% not the 10%

[davidjgraph]

So, just to clarify. The constructive solution is to submit a PR. If you behave like a 4 year old, like our friend @complib2891 , you'll just be banned.

[rmsilva1973]

@davidjgraph People behaving like a 4 year old should be kicked out indeed. BUT... Doesn't the README.md for the project states that it isn't open to PRs?

[davidjgraph]

I'm allowed to bend any rules I like :). I'll take a PR on this, I don't know what to change and don't have an Ubutnu install to start testing.

But please note, there's a trend to create a chatgpt suggestion of PR, submit it and say "ok there". The PR doesn't work and we have to go and work out the whole thing from scratch and debug it ourselves. So, PRs are OK here, but fully tested PRs...