chromium 61 doesn't start in guest session

I can't reproduce the problem in a clean xenial VM.
When you say you can locate libffmpeg.so, where is it installed?

Does the following command improve things?

    sudo apt install --reinstall chromium-codecs-ffmpeg-extra

I have done that to no avail.

libffmpeg is installed in /usr/lib/chromoium-browser/libffmpeg.so and /usr/lib/x86_64-linux-gnu/oxide-qt/libffmpeg.so

On 22/09/2017 12:20, Olivier Tilloy wrote:

I can't reproduce the problem in a clean xenial VM.
When you say you can locate libffmpeg.so, where is it installed?

Does the following command improve things?

    sudo apt install --reinstall chromium-codecs-ffmpeg-extra

--
--
Klaus Merkel
IT Specialist
--
LAN1 Hotspots GmbH
Gau?stra?e 158
22765 Hamburg

Hotline +49 40 317 66 66 66
Tel. +49 40 317 66 66 - 59
Fax +49 40 317 66 66 - 33
Mobil 01522 260 22 00
<email address hidden><mailto:<email address hidden>>
www.lan1.de<http://www.lan1.de>
Sitz der Gesellschaft: Hamburg
Handelsregister Hamburg HRB 118700
Gesch?ftsf?hrer: J?rg H?mmer
Ust.-ID-Nr. DE277065194

Status changed to 'Confirmed' because the bug affects multiple users.

This also affects us. It started on Sep 22 on part of our test servers as soon as chromium-browser upgraded to 61 from 60. What I have found so far:

Chromium 60 uses libraries from its folder:

---------------------
ubuntu@test4:~$ sudo apt-cache policy chromium-browser
chromium-browser:
  Installed: 60.0.3112.113-0ubuntu0.16.04.1298
  Candidate: 61.0.3163.79-0ubuntu0.16.04.1300
  Version table:
     61.0.3163.79-0ubuntu0.16.04.1300 500
        500 http://mirror.hetzner.de/ubuntu/packages xenial-updates/universe amd64 Packages
        500 http://mirror.hetzner.de/ubuntu/security xenial-security/universe amd64 Packages
        500 http://de.archive.ubuntu.com/ubuntu xenial-updates/universe amd64 Packages
        500 http://security.ubuntu.com/ubuntu xenial-security/universe amd64 Packages
 *** 60.0.3112.113-0ubuntu0.16.04.1298 100
        100 /var/lib/dpkg/status
     49.0.2623.108-0ubuntu1.1233 500
        500 http://mirror.hetzner.de/ubuntu/packages xenial/universe amd64 Packages
        500 http://de.archive.ubuntu.com/ubuntu xenial/universe amd64 Packages
-----------------------
ubuntu@test4:~$ ldd /usr/lib/chromium-browser/chromium-browser
        linux-vdso.so.1 => (0x00007ffd2a9cd000)
        libpthread.so.0 => /lib/x86_64-linux-gnu/libpthread.so.0 (0x00007f3431380000)
        libembedder.so => /usr/lib/chromium-browser/./libembedder.so (0x00007f343113c000)
        libbindings.so => /usr/lib/chromium-browser/./libbindings.so (0x00007f3430f0b000)
        libbase.so => /usr/lib/chromium-browser/./libbase.so (0x00007f3430b45000)
        libmojo_public_system_cpp.so => /usr/lib/chromium-browser/./libmojo_public_system_cpp.so (0x00007f343093b000)
        libmojo_public_system.so => /usr/lib/chromium-browser/./libmojo_public_system.so (0x00007f3430737000)
        libnet.so => /usr/lib/chromium-browser/./libnet.so (0x00007f342ff02000)
        libprotobuf_lite.so => /usr/lib/chromium-browser/./libprotobuf_lite.so (0x00007f342fcc8000)
        libcrcrypto.so => /usr/lib/chromium-browser/./libcrcrypto.so (0x00007f342fab2000)
        libboringssl.so => /usr/lib/chromium-browser/./libboringssl.so (0x00007f342f72f000)
        liburl.so => /usr/lib/chromium-browser/./liburl.so (0x00007f342f50a000)
        libbase_i18n.so => /usr/lib/chromium-browser/./libbase_i18n.so (0x00007f342f2b1000)
        libicui18n.so => /usr/lib/chromium-...

People with working chromium-browser 61 could you please post those commands outputs here?

-----------
apt-cache policy chromium-browser
ldd /usr/lib/chromium-browser/chromium-browser
-----------

Maybe it'll help investigate this thing.

All nine of our kiosks, running a mix of Ubuntu 14.04.5 LTS and 16.04.3 LTS, are now exhibiting this bug. So we can definitely reproduce it on a mix of hardware and software. Uninstalling and reinstalling Chromium did not help.

Here's someone else's forum post on the same topic too:

https://askubuntu.com/questions/958378/chromium-will-not-start-in-guest-session-on-ubuntu-16-04-3-lts

As the original bug report notes, it only affects guest session users, not regular users. While logged in as a regular user, though, it can be demonstrated by trying to run Chromium via the lightdm-guest-session:

$ /usr/lib/lightdm/lightdm-guest-session /usr/bin/chromium-browser
/usr/lib/chromium-browser/chromium-browser: error while loading shared libraries: libffmpeg.so: cannot open shared object file: No such file or directory

Now libffmpeg.so *is* provided as part of the Chromium install, under /usr/lib/chromium-browser/libffmpeg.so, and simply copying it to a standard directory allows Chromium to launch via the guest session:

$ sudo cp /usr/lib/chromium-browser/libffmpeg.so /usr/lib/x86_64_linux_gnu
$ /usr/lib/lightdm/lightdm-guest-session /usr/bin/chromium-browser
[Chromium launches]

Obviously, that's not an ideal solution.

I also found that disabling AppArmor's profile for the LightDM guest session allowed the above test to succeed (i.e., to launch Chromium):

$ sudo apparmor_parser -R /etc/apparmor.d/lightdm-guest-session
$ /usr/lib/lightdm/lightdm-guest-session /usr/bin/chromium-browser
[Chromium launches]

Or, editing out the #include statement in /etc/apparmor.d/lightdm-guest-session which includes the sub-profile /etc/apparmor.d/abstractions/lightdm_chromium-browser and then reloading AppArmor also worked:

[comment out #include of abstractions/lightdm_chromium-browser in lightdm-guest-session]
$ sudo apparmor_parser -r /etc/apparmor.d/lightdm-guest-session
$ /usr/lib/lightdm/lightdm-guest-session /usr/bin/chromium-browser
[Chromium launches]

Interestingly, nothing is captured in /var/log/kern.log; there's no obvious error message here.

Digging into the /etc/apparmor.d/abstractions/lightdm_chromium-browser configuration, it looks like the Chromium binary is executed with the "Cx" settings, e.g.:

/usr/lib/chromium-browser/chromium-browser Cx -> chromium

According to the man page (http://manpages.ubuntu.com/manpages/xenial/en/man5/apparmor.d.5.html), the "Cx" setting means "transition to subprofile on execute -- scrub the environment".

Now, the /usr/bin/chromium-browser shell script has some code which sets LD_LIBRARY_PATH to include /usr/lib/chromium-browser, precisely so that libffmpeg.so can be located by the runtime linker.

My guess, therefore, is that the AppArmor sub-profile for Chromium is causing LD_LIBRARY_PATH to be scrubbed from the environment, so libffmpeg.so can not be located at runtime.

One other oddity is why all our LTS machines (both 14.04 and 16.04) now have libffmpeg.so in /usr/lib/chromium-browser, not /usr/lib/chromium-browser/libs. But when I checked with dpkg-query, the former (/usr/lib/chromium-browser/libffmpeg.so) is definitely what was listed, and that's where the shared library was installed.

I'm not at the kiosks now and can't run apt-cache, but I did run ldd earlier, and can report that for the Chromium binary (/usr/lib/chromium-browser/chromium-browser) ldd reports libffmpeg.so as not found. That's why the shell script /usr/bin/chromium-browser sets LD_LIBRARY_PATH=/usr/lib/chromium-browser before executing the binary. That allows libffmpeg.so to be located for regular users, but not for guest users -- as I noted, I think that's because of the interaction of the AppArmor "Cx" setting for Chromium, which causes the environment variables to be scrubbed just before the binary is executed. That's my guess, anyway.

> One other oddity is why all our LTS machines (both 14.04 and 16.04) now have libffmpeg.so
> in /usr/lib/chromium-browser, not /usr/lib/chromium-browser/libs. But when I checked
> with dpkg-query, the former (/usr/lib/chromium-browser/libffmpeg.so) is definitely
> what was listed, and that's where the shared library was installed.

This is because libs is a symlink to parent folder:

ubuntu@test4:~$ ls -la /usr/lib/chromium-browser/libs
lrwxrwxrwx 1 root root 1 Mar 18 2017 /usr/lib/chromium-browser/libs -> .

> That's why the shell script /usr/bin/chromium-browser sets LD_LIBRARY_PATH=/usr/lib/chromium-browser before executing the binary.

Yeah, with this info there is no need in ldd output, as it is not super related to the problem.

Confirmed, in chromium 60.0.3112.113 ldd was able to locate libffmpeg.so:

$ ldd /usr/lib/chromium-browser/chromium-browser | grep ffmpeg
        libffmpeg.so => /usr/lib/chromium-browser/./libffmpeg.so (0x00007fec793cc000)

In chromium 61.0.3163.79, it can't locate it:

$ ldd /usr/lib/chromium-browser/chromium-browser | grep ffmpeg
        libffmpeg.so => not found

Chromium 60 was built with is_component_build=true. Chromium 61 is built with is_component_build=false, and in that configuration the rpath does not contain the directory where shared libs (such as libffmpeg.so) are built. There's a good explanation of why there: https://cs.chromium.org/chromium/src/build/config/gcc/BUILD.gn?l=48.

And the following fixes the issue:

    sudo patchelf --set-rpath "\$ORIGIN/." /usr/lib/chromium-browser/chromium-browser

patchelf is not available in trusty, so that won't work to set the rpath on the binary after the build. Will need to patch chromium to set the rpath at build time.

From duplicate bug #1719300, the chromedriver binary also needs the rpath.

This bug was fixed in the package chromium-browser - 61.0.3163.100-0ubuntu0.17.04.1377

---------------
chromium-browser (61.0.3163.100-0ubuntu0.17.04.1377) zesty; urgency=medium

  * debian/patches/set-rpath-on-chromium-executables.patch: added
    (LP: #1718885)
  * debian/chromium-browser.sh.in: remove LD_LIBRARY_PATH manipulation,
    made unnecessary by patch above

 -- Olivier Tilloy <email address hidden> Tue, 26 Sep 2017 09:48:13 -0400

This bug was fixed in the package chromium-browser - 61.0.3163.100-0ubuntu0.14.04.1202

---------------
chromium-browser (61.0.3163.100-0ubuntu0.14.04.1202) trusty; urgency=medium

  * debian/patches/set-rpath-on-chromium-executables.patch: added
    (LP: #1718885)
  * debian/chromium-browser.sh.in: remove LD_LIBRARY_PATH manipulation,
    made unnecessary by patch above

 -- Olivier Tilloy <email address hidden> Tue, 26 Sep 2017 10:01:47 -0400

This bug was fixed in the package chromium-browser - 61.0.3163.100-0ubuntu0.16.04.1306

---------------
chromium-browser (61.0.3163.100-0ubuntu0.16.04.1306) xenial; urgency=medium

  * debian/patches/set-rpath-on-chromium-executables.patch: added
    (LP: #1718885)
  * debian/chromium-browser.sh.in: remove LD_LIBRARY_PATH manipulation,
    made unnecessary by patch above

 -- Olivier Tilloy <email address hidden> Tue, 26 Sep 2017 09:53:03 -0400