Package Details: sieve-app-bin 0.6.1-3

Git Clone URL: https://aur.archlinux.org/sieve-app-bin.git (read-only, click to copy)
Package Base: sieve-app-bin
Description: Sieve script editor app version
Upstream URL: https://github.com/thsmi/sieve/
Licenses: AGPL3
Submitter: kolewu
Maintainer: kolewu
Last Packager: kolewu
Votes: 5
Popularity: 0.197025
First Submitted: 2022-03-13 00:03 (UTC)
Last Updated: 2024-01-13 22:29 (UTC)

Latest Comments

kolewu commented on 2024-01-13 21:54 (UTC) (edited on 2024-01-13 21:55 (UTC) by kolewu)

@Zoddo: Thanks for bringing this to my attention! But now I am obliged to check that the chrome-sandbox binary coming in the binary package I'm using in this recipe, is the clean one that deserves to be run as root. And it's even more tough, because the release package uses such an old electron build (15.3.0). So I have to choose between suid'ing an old and unknown wrapper app or limiting the package to be only used in not strict configured environments regarding user namespaces.

I think for now, I will go with the first variant, but with a bad taste in my mouth.

Zoddo commented on 2024-01-13 20:46 (UTC)

@kolewu: It's not Chrome itself, but the sandbox helper that needs to run as root. This happens if you disable unprivileged user namespace with sysctl (kernel.unprivileged_userns_clone=0) which is a recommended hardening method to enable.

The SUID flag is already set on official packages such as chromium or electron so you should be fine to set it :)

kolewu commented on 2024-01-13 20:12 (UTC)

Thanks Necoro. I finally have managed to merge your changes. Sorry for the delay.

MrGamy: With the above changes unzip is no longer necessary.

Zoddo: Cannot reproduce your issue. It should absolutely never be necessary to start something like Chrome as root!

MrGamy commented on 2024-01-09 11:52 (UTC)

please add unzip as a dependency

Zoddo commented on 2023-12-27 18:40 (UTC) 

sieve-app.desktop[2145953]: [2145953:1227/193709.667530:FATAL:setuid_sandbox_host.cc(158)] The SUID sandbox helper binary was found, but is not configured correctly. Rather than run without sandboxing I'm aborting now. You need to make sure that /opt/sieve-app/chrome-sandbox is owned by root and has mode 4755.

Looks like you are missing a chmod u+s "${pkgdir}/opt/${_appname}/chrome-sandbox"

Necoro commented on 2022-09-22 23:11 (UTC)

Hi kolewu,

I updated the PKGBUILD to fix the following shortcomings: * Invalid license name * Missing required dependencies * Instead of using unzip (which would add another dependency), rely on builtin extraction

You can find the PKGBUILD at https://git.necoro.dev/aur/sieve-app-bin.git, which can also be directly used for pulling/merging.