"SUID sandbox helper binary" warning on debian 10

[masx200]

Describe the bug

Unable to run the program GitHubDesktop.

[6028:0303/110012.970291:FATAL:setuid_sandbox_host.cc(157)] 
The SUID sandbox helper binary was found, but is not configured correctly. 
Rather than run without sandboxing I'm aborting now. 
You need to make sure that /home/ma/GitHubDesktop-linux-2.3.1-linux1.deb/data/opt/GitHub Desktop/chrome-sandbox is owned by root and has mode 4755.
追踪与中断点陷阱
Trace and breakpoint traps

Version & OS

GitHubDesktop-linux-2.3.1-linux1.deb

Linux ma-pc 4.19.0-8-amd64 #1 SMP Debian 4.19.98-1 (2020-01-26) x86_64 GNU/Linux

Debian GNU/Linux 10 (buster)

Steps to reproduce the behavior

github-desktop

Expected behavior

A clear and concise description of what you expected to happen.

Actual behavior

A clear and concise description of what actually happened.

Screenshots

Add screenshots to help explain your problem, if applicable.

Logs

Attach your logs by opening the Help menu and selecting Show Logs..., if applicable.

Additional context

Add any other context about the problem here.

[quizilkend]

Happens to me as well.
If the permission are changed according to the error message github desktop aborts anyway.

Happens with the appimage as well.

./github-desktop.AppImage [24186:0319/111744.233413:FATAL:setuid_sandbox_host.cc(157)] The SUID sandbox helper binary was found, but is not configured correctly. Rather than run without sandboxing I'm aborting now. You need to make sure that /tmp/.mount_githubGt9pWR/chrome-sandbox is owned by root and has mode 4755. fish: “./github-desktop.AppImage” terminated by signal SIGTRAP (Verfolgungs- oder Haltepunkt erreicht)

[StygianBlues]

If one is okay with with the possible risks, as temporary workaround:

sudo sysctl kernel.unprivileged_userns_clone=1

Or to make the change survive reboot add kernel.unprivileged_userns_clone=1 to /etc/sysctl.conf (or /etc/sysctl.d ) and run sudo sysctl --system

[quizilkend]

I just read about that, and I'm not okay with the additional risks.
Hopefully there will be another solution to this issue.

[shiftkey]

Looks like there's a packaging change that I need to make, based on electron/electron#17972

@quizilkend @StygianBlues can you share what the permissions are for /opt/GitHub Desktop/chrome-sandbox on your machine as I'm not seeing the same problem with 2.4.0-linux1 which suggests it might have been resolved.

[StygianBlues]

Permissions on my /opt/GitHub Desktop/chrome-sandbox file are 755 (rwxr-xr-x). My machine's kernel: 5.4.0-4-rt-amd64 #1 SMP PREEMPT_RT Debian 5.4.19-1 (2020-02-13) x86_64 GNU/Linux.

Thank you for all the work you do in keeping this available on Linux.

[shiftkey]

Actually, this comment from inside the electron-installer-helper package here seems important:

/**
   * For Electron versions that support the setuid sandbox on Linux, changes the permissions of
   * the `chrome-sandbox` executable as appropriate.
   *
   * The sandbox helper executable must have the setuid (`+s` / `0o4000`) bit set.
   *
   * This doesn't work on Windows because you can't set that bit there.
   *
   * See: https://github.com/electron/electron/pull/17269#issuecomment-470671914
   */

I believe this would change the permission to -rwsr-xr-x (note the s instead of x for the owner), and that's not present in the latest version either.