I am experiencing very weird and suspicious issue on debian 12. For context, I am using grsecurity + RBAC, which gives me the possibility to see what files each program wants to access. My issue is not caused by RBAC. but RBAC brought my attention to this issue. SO, I have upgraded chromium browser to: 138.0.7204.49 and suddenly when chromium starts, in addition to trying to access the usual files in my home, such as ~/.config/chromium or ~/.cache , it now tries to access sensitive folders on my system: ~/.ssh/ ~/.gnupg/ ~/.dbus/ /boot/ (while ~/.dbus is not as immediately alarming as the others, Chromium accessing this when it didn't before is still a change in behavior that deserves scrutiny) this never happened before. I am sure, because the RBAC rules that I am using would have alerted me. this is highly suspicious and potentially a serious security issue !
Hi, Thanks for the report. Please run chromium under strace so that we can see what it's doing, and send it here. Eg, `strace -f --trace=openat chromium &> c138.log` Thanks, Andres
originally, I have reported this issue on chromium 138.0.7204.49-1~deb12u1 the problem got fixed by upgrading chromium to next version but now, after upgrading to Version 140.0.7339.80 the problem is back: here is my RBAC reporting chromium trying to open files that it has no business opening: 07:13:43 grsec: (testuser:U:/usr/lib/chromium/chromium) denied access to hidden file /home/testuser/.ssh by /usr/lib/chromium/chromium[ThreadPoolForeg:7646] uid/euid:1000/1000 gid/egid:1000/1000, parent /usr/sbin/init[init:1] uid/euid:0/0 gid/egid:0/0 07:13:43 grsec: (testuser:U:/usr/lib/chromium/chromium) denied access to hidden file /home/testuser/.gnupg by /usr/lib/chromium/chromium[ThreadPoolForeg:7646] uid/euid:1000/1000 gid/egid:1000/1000, parent /usr/sbin/init[init:1] uid/euid:0/0 gid/egid:0/0 07:13:43 grsec: (testuser:U:/usr/lib/chromium/chromium) denied access to hidden file /boot by /usr/lib/chromium/chromium[ThreadPoolForeg:7646] uid/euid:1000/1000 gid/egid:1000/1000, parent /usr/sbin/init[init:1] uid/euid:0/0 gid/egid:0/0 07:13:43 grsec: (testuser:U:/usr/lib/chromium/chromium) denied access to hidden file /home/testuser/.dbus by /usr/lib/chromium/chromium[ThreadPoolForeg:7646] uid/euid:1000/1000 gid/egid:1000/1000, parent /usr/sbin/init[init:1] uid/euid:0/0 gid/egid:0/0 why is chromium doing this, and why does Debian tolerate this behavior ?
Control: tags -1 + moreinfo As I said, it would be helpful if you could send an strace to show exactly what's attempting to be opened. Chromium specifically has code to disallow access to special directories, but recent changes to optimize the blocklist ( https://chromium.googlesource.com/chromium/src/+/e067077375020cf7c7cd1b27cee529e8db5f6ce3%5E%21/ , https://chromium.googlesource.com/chromium/src/+/37141c231485b178e8d9a6064916a1016311f207%5E%21/ ) may have made it so that it first queries those directories for existence before adding them to the blocklist (or similar unintended consequences).
thanks for the update. the troubleshooting you suggest would require me to run chromium with strace and let it have unrestricted access to my sensitive data I would have to set up some testing laptop for that, asI don't want to do it on my main laptop and risk having my life ssh and gpg keys compromised I hoped it would be enough to report this weird behavior, and the maintainers / developers can run these tests themselves, as they are surely better equipped for that than I am