[vpacher]

Step A of the Linux sandbox work in obs-rust/obs-studio#1092 (the pre-check before CefInitialize), and the log part of B.

B was decided on 2026-10-24 (obs-rust/obs-studio#1092 (comment)): when no sandbox can work, the browser runs without it, the reason is logged and goes to stderr, and the user gets a warning with an "Accept anyway" countdown. This PR does the log and stderr part. The warning dialog follows in separate PRs (a shared frontend helper in obs-studio, then its use here). The .deb packaging (C) is separate too.

Change

• browser-sandbox.{hpp,cpp}: DecideSandbox, a pure function over a probe (platform supported, root, user namespaces, state of chrome-sandbox), and ProbeSandbox for Linux:
  • user namespaces: a forked child does what Chromium's namespace sandbox does. It unshares user, PID and network namespaces, then maps its own uid and gid. A sysctl alone misses the AppArmor restriction and seccomp filters.
  • chrome-sandbox next to libcef (or at CHROME_DEVEL_SANDBOX): setuid root means owned by root, setuid, executable, and not on a nosuid mount.
• BrowserInit sets settings.no_sandbox from the decision, and logs the decision and the reason. When no sandbox can work, it runs as before (no_sandbox), so nobody loses their browser sources. Windows and macOS have no probe yet and are unchanged.

Probe	Decision
no probe for the platform	off (as today)
root	off (Chromium exits the process when it runs sandboxed as root)
user namespaces	namespace sandbox
no user namespaces, chrome-sandbox setuid root	setuid helper
no user namespaces, chrome-sandbox absent or not setuid	off (Chromium aborts on a helper that is not setuid)

Tests

• 67f32cf RED: tests/sandbox_decision.py, 9 cases, all fail against a stub. 48aa373 GREEN: 9/9 (macOS and Linux).

• d9faaa1 RED: SandboxFallback, 6 more cases in tests/sandbox_decision.py; the 3 fallback cases (root; no user namespaces with a helper that is not setuid; no user namespaces and no helper) fail against a stub. 87ba6a2 GREEN: 15/15.

• Fallback log line, real module (obs-rust/obs-studio d5960eac6, CEF 8078, Debian 13 LXC):

  • root: [obs-browser]: CEF sandbox off: OBS runs as root. Browser sources run without the sandbox. at error level, so OBS echoes it once to stderr. Renders.
  • normal user: CEF sandbox on: user namespaces are available at info level, as before. Renders.
  • Windows and macOS (no probe): the line stays at info level.

• tests/sandbox_probe.py prints the probe and the decision in the current environment. Debian 13 LXC container, CEF 7871 chrome-sandbox: root and every helper state gives off; a normal user and every helper state gives namespaces; a normal user with RestrictNamespaces=~user gives off, off (not setuid) and the setuid helper.

• Real module (obs-rust/obs-studio master 9f2253334, CEF 7871, Browser Source with a JavaScript page, read back through GetSourceScreenshot):

  • root: CEF sandbox off: OBS runs as root, renders, every CEF process has --no-sandbox (as today).
  • normal user: CEF sandbox on: user namespaces are available, renders. The renderers and one utility process have their own user and PID namespace and seccomp-bpf.
  • normal user, RestrictNamespaces=~user: CEF sandbox off: no user namespaces, and chrome-sandbox is not setuid root, renders. With no_sandbox = false alone, OBS aborted here.

• Ubuntu 24.04.5 VM (kernel 6.8.0-147, kernel.apparmor_restrict_unprivileged_userns = 1, AppArmor on). The test host is a minimal CEF 7871 program: CefInitialize with no_sandbox = false, a separate subprocess binary as with obs-browser-page, and this probe in the main process. The probe agrees with Chromium in every case:

  Case	Probe	Chromium with the sandbox on
  stock, chrome-sandbox present, not setuid (as the .deb installs it)	off	aborts: "The SUID sandbox helper binary was found, but is not configured correctly"
  stock, no chrome-sandbox	off	aborts: "No usable sandbox!"
  stock, no_sandbox = true (as today)	off	runs
  AppArmor profile with userns on the subprocess binary only	off	aborts: "No usable sandbox!"
  AppArmor profile with userns on the main binary	on	runs; the sandboxed zygote has its own user namespace

  On stock Ubuntu 24.04, unshare(CLONE_NEWUSER) itself succeeds and only the uid_map write fails, so the probe has to map the uid, as it does.

  For C on #1092: the user namespaces are created by the process that hosts CEF. An AppArmor profile therefore has to cover the OBS executable, not obs-browser-page.

Refs obs-rust/obs-studio#1092

CEF 8078 (2026-10-24)

Linux x86_64 now uses CEF 8078 (obs-rust/obs-studio#1948). I ran the same tests again. The code of this PR did not change.

• Real module: obs-rust/obs-studio master d5960eac6, CEF 156.0.8+g426920c+chromium-156.0.8078.48, this PR merged onto the obs-browser pin 7bab463 (no conflicts). Browser source with a JavaScript page, read back through GetSourceScreenshot:
  • root: CEF sandbox off: OBS runs as root, renders, every CEF process has --no-sandbox.
  • normal user: CEF sandbox on: user namespaces are available, renders. The renderers and one utility process have their own user and PID namespace and seccomp-bpf.
  • normal user, RestrictNamespaces=~user: CEF sandbox off: no user namespaces, and chrome-sandbox is not setuid root, renders.
• Ubuntu 24.04.5 VM (kernel 6.8.0-147, kernel.apparmor_restrict_unprivileged_userns = 1), minimal CEF 8078 host: the probe agrees with Chromium in all five cases, with the same results as the table above.

The decision and the probe do not depend on the CEF version.

🤖 Generated with Claude Code