Skip to content

fix: crashReporter incompatible with sandbox on Linux #23265

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 91 commits into from
May 7, 2020

Conversation

nornagon
Copy link
Contributor

@nornagon nornagon commented Apr 23, 2020

Description of Change

This refactors crashReporter, making the following changes:

  1. Calling crashReporter.start from the renderer process is now deprecated, and only has the effect of setting extra parameters. Child processes will be automatically tracked if they're started after the crash reporter is initialized in the main process.
  2. Additionally, getLastCrashReport, getUploadedReports, getUploadToServer, setUploadToServer, and getCrashesDirectory are also deprecated in the renderer process. Only addExtraParameter, removeExtraParameter and getParameters remain non-deprecated in the renderer.
  3. There's a new parameter to crashReporter.start called globalExtra. Parameters passed in here will be included with any crash reported from any process, but cannot be changed after initialization. Parameters in extra or added by addExtraParameter will be included only with crashes in the process in which they're added, and they can be changed dynamically, as before. By default, the product name and app version (as reported by app.getVersion() when the crash reporter is started) are included in the global extra parameters.
  4. The companyName parameter is no longer required, and further, is deprecated.

All above deprecated options will be removed in v12.x, and the majority of the crashReporter API will become main-process-only.

The reasons for making this change are as follows.

  • Prior to this change, on Linux, crashReporter is incompatible with sandboxed renderers, because it must be initialized with crashReporter.start() in the renderer, but when the sandbox is engaged, crashReporter.start() cannot run on Linux. The only way to resolve this is to enable the crash reporter before the sandbox is engaged, which means before JavaScript is able to run. Thus, all the configuration must come from the main process.
  • On Mac and Windows, which use crashpad, this is already how the crash reporter works, but the API does not make that clear, and in fact provides ample opportunity for misuse. In particular, for example:
    • Calling crashReporter.start() from a renderer process without having first initialized the crash reporter in the main process will not result in crashes being collected from that renderer, as crashpad won't have been initialized when the renderer was launched.
    • Most of the information passed to crashReporter.start() is ignored if the crash reporter is already enabled, including the submitURL parameter, despite it being a required parameter in the API.

Fixes #23124.

Checklist

Release Notes

Notes: crashReporter is now explicitly initialized only in the main process, and implicitly initialized in other child processes. This fixes an issue preventing the crash reporter from functioning in sandboxed renderers on Linux.

@electron-cation electron-cation bot added the new-pr 🌱 PR opened recently label Apr 23, 2020
@nornagon
Copy link
Contributor Author

nornagon commented Apr 23, 2020

Hm, might be able to make this change not-breaking, just a deprecation, and break it in v12.

  • crashReporter.start in the renderer could be implemented in JS as:
    1. ipc message to the main process to start the crash reporter if it isn't already, passing along its params turns out the current impl doesn't do this.
    2. set extra params locally in the process
    3. print a deprecation warning
  • getLastCrashReport, getUploadedReports, getUploadToServer, setUploadToServer, and getCrashesDirectory could be proxied over to the main process via sendSync, also printing a deprecation warning.

This would be nice to give a softer landing to this feature.

@electron-cation electron-cation bot removed the new-pr 🌱 PR opened recently label Apr 24, 2020
@nornagon
Copy link
Contributor Author

nornagon commented May 7, 2020

I disabled some tests on ARM. I manually verified that the crash reporter does in fact function correctly at least some of the time on linux/arm64. On linux/arm32, I had issues with crash reports in the main process, though renderer-side crash reports seemed fine.

I'd like to get these tests fixed, but given the crash reporter seems to mostly work on arm outside of a CI environment, and this PR enables more tests than were previously enabled on those platforms, I'm OK merging and continuing work on fixing the tests in a followup.

@nornagon
Copy link
Contributor Author

nornagon commented May 7, 2020

CI failures are unrelated. merging.

@nornagon nornagon merged commit 06bf0d0 into master May 7, 2020
@release-clerk
Copy link

release-clerk bot commented May 7, 2020

Release Notes Persisted

crashReporter is now explicitly initialized only in the main process, and implicitly initialized in other child processes. This fixes an issue preventing the crash reporter from functioning in sandboxed renderers on Linux.

@nornagon nornagon deleted the crash-reporter-refactor branch May 7, 2020 20:31
@trop
Copy link
Contributor

trop bot commented May 7, 2020

I was unable to backport this PR to "9-x-y" cleanly;
you will need to perform this backport manually.

@trop
Copy link
Contributor

trop bot commented May 7, 2020

@nornagon has manually backported this PR to "9-x-y", please check out #23461

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Crash reporting on Linux is incompatible with sandbox
3 participants