Thorium does not work on some versions of Linux distributions

[llemeurfr]

From a user:
Linux versions of thorium reader 3.0.0 and 3.0.1 alpha (amd64, either deb and AppImage) do not work here on Linux Mint 22. Freezes after importing ebooks, no reaction after opening the books.

[danielweck]

My Linux distribution is Linux Mint 21.3 Virginia (which is based on Ubuntu 22.04 jammy) as shown by lsb_release -a

ldd --version
===>
ldd (Ubuntu GLIBC 2.35-0ubuntu3.8) 2.35

ldd `which ls` | grep libc

libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6

===> GNU C Library (Ubuntu GLIBC 2.35-0ubuntu3.8) stable release version 2.35.

The AppImage runs fine, the library window behaves as normal, but the reader window is completely broken: several seconds wait between each interaction with the GUI or the publication content. Sometimes the React UI does not display at all (the pub info dialog, for example)

Same story when installing the Debian package.

The CPU spikes hard for several seconds when interacting (mouse clicking) in the reader window.

[gautierchomel]

See electron/electron#42019

[danielweck]

@p-kenny reported in #2525

I am using Thorium 3.0.0 AppImage on OpenSUSE Tumbleweed and Gnome 46.

Since starting to use this version I have noticed that loading an epub file is taking a very long time. I have tried several files that worked well on previous versions so can discount the files themselves.

Great new look by the way!

Thanks
Paul

[kianmeng]

Not working as well for Ubuntu 24.04.1 LTS.

$ ./Thorium-3.0.0.AppImage 
[38735:0929/163413.711061:FATAL:setuid_sandbox_host.cc(158)] The SUID sandbox helper binary was
found, but is not configured correctly. Rather than run without sandboxing I'm aborting now.
You need to make sure that /tmp/.mount_Thoriu3vJmSQ/chrome-sandbox is owned by root and has 
mode 4755.
Trace/breakpoint trap (core dumped)

[mbennette68]

Thorium-3.1.0-alpha.1.11177520504.AppImage also does not work on Ubuntu 22.04 LTS variants (Pop!_OS).

Basically the books (e.g. PDF & EPUB in my case) can be loaded but once opened for actual reading, it is difficult
to move from page to page or even within the page. Navigation through the pages is very sluggish.

[susancragin]

Needs to use a more recent fuse also. Needs fuse2, distro have moved to 3.

[danielweck]

Hello, Thorium is packaged automatically by Electron Builder to distribute on Windows, Linux, Mac OS. I expect that as we update the build process software dependencies, Thorium will automatically benefit from the latest and greatest tech available.

[dajare]

At the risk of only adding a "me too" to this issue, ... me too. ☹️ Same as @kianmeng :

Not working as well for Ubuntu 24.04.1 LTS.

$ ./Thorium-3.0.0.AppImage 
[38735:0929/163413.711061:FATAL:setuid_sandbox_host.cc(158)] The SUID sandbox helper binary was
found, but is not configured correctly. Rather than run without sandboxing I'm aborting now.
You need to make sure that /tmp/.mount_Thoriu3vJmSQ/chrome-sandbox is owned by root and has 
mode 4755.
Trace/breakpoint trap (core dumped)

It would be good to have Thorium working "out of the box" on current Ubuntu.

[aigan]

Epubs are also super-slow for me. More than 10 second for any action. For Thorium 3.0 and 3.1.

root@hem:~# lsb_release -a
No LSB modules are available.
Distributor ID: Debian
Description:    Debian GNU/Linux 12 (bookworm)
Release:        12
Codename:       bookworm
root@hem:~# ldd --version
ldd (Debian GLIBC 2.38-13) 2.38
root@hem:~# ldd `which ls` | grep libc
        libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007ff93e667000)

[danielweck]

The chrome-sandbox problem reminds me of:

• The SUID sandbox helper binary was found, but is not configured correctly. #1472
• https://github.com/mattermost/desktop/blob/742a0c0dd41cae9cc224e729228e280be4a94bf8/scripts/afterpack.js#L9-L22

• thorium-reader/Dockerfile

  Lines 112 to 113 in 4177be7

  	./node_modules/electron/dist/electron --no-sandbox --version &&\
  	./node_modules/electron/dist/electron --no-sandbox --abi

[danielweck]

The chrome-sandbox SUID permission problem has affected many mainstream Electron-based applications, so this is now a well-documented problem. It will be solved in ElectronBuilder v26 for the Debian package installer but not for the AppImage due to its transient nature. Unbuntu's latest AppArmor security policy broke apps in v24:

https://discourse.ubuntu.com/t/ubuntu-24-04-lts-noble-numbat-release-notes/39890#p-99950-security-improvements

https://github.com/electron-userland/electron-builder/releases/tag/v26.0.0-alpha.6

The alternative methods bring their security trade-offs, to be considered carefully:

• /PATH/TO/Thorium.AppImage --no-sandbox or /PATH/TO/thorium --no-sandbox
• sudo chown root:root ./PATH/TO/APP/Thorium/chrome-sandbox && sudo chmod 4775 ./PATH/TO/Thorium/chrome-sandbox (or directly in node_modules/electron/dist/ at build time ... at the risk of making files not accessible to non-root users) See

  thorium-reader/scripts/afterPack.js

  Lines 6 to 19 in b15efb6

  	// const { spawnSync } = require("child_process");
  	// const SETUID_PERMISSIONS = '4755';
  	// function fixSetuid(context) {
  	// return async (target) => {
  	// if (!['appimage', 'snap'].includes(target.name.toLowerCase())) {
  	// const result = await spawnSync('chmod', [SETUID_PERMISSIONS, path.join(context.appOutDir, 'chrome-sandbox')]);
  	// if (result.error) {
  	// throw new Error(
  	// `Failed to set proper permissions for linux arch on ${target.name}: ${result.error} ${result.stderr} ${result.stdout}`,
  	// );
  	// }
  	// }
  	// };
  	// }

• sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0
• echo 0 | sudo tee /proc/sys/kernel/apparmor_restrict_unprivileged_userns

PS: note that on a fresh Ubuntu distro I had to manually install Fuse for the AppImage, and zlib1g-dev for libz.so which is needed by the Thorium executable (because libz.so.1 only in zlib1g ... it's a known problem with ElectronBuilder apparently too) ... aaah, Linux 👍

https://github.com/electron-userland/electron-builder/blob/6a294c9725f30cf1b6151363a32b9d1395b0122e/packages/app-builder-lib/templates/linux/after-install.tpl#L13-L19

https://github.com/electron-userland/electron-builder/pull/8368/files#diff-ce484dcb54be40b46ebfd55f8447dd6fcbd028bc84bd5df28daa78fc1df2f518

[gautierchomel]

I'm happy to report that [latest-linux-intel] automated test build (beta) Pre-release works smoothly on my ThinkPad X1 Debian trixie testing with GNOME 47and Wayland :)

[dajare]

Ah, hope! But alas, in my case, short lived. I installed from the 3.1.0-alpha-1 .deb file:

$ thorium
[41141:1209/153946.557310:FATAL:setuid_sandbox_host.cc(163)] The SUID sandbox helper 
binary was found, but is not configured correctly. Rather than run without sandboxing I'm 
aborting now. You need to make sure that /opt/Thorium/chrome-sandbox is owned by root 
and has mode 4755.
Trace/breakpoint trap (core dumped)

So no change from my previous experience, unfortunately. (Ubuntu 24.04.1 LTS; Wayland)

[danielweck]

Hello, that's "normal" I am afraid, for now anyway :)
This is a bug in the Electron builder / packager caused by a breaking change related to security (AppArmor) in some Linux distributions. The workaround will hopefully be available shortly in an official release, in time for Thorium 3.1

[danielweck]

...so in your case, you can:

sudo chmod 4755 /opt/Thorium/chrome-sandbox

[danielweck]

...or launch with:

/opt/Thorium/thorium --no-sandbox

[dajare]

@danielweck - Many thanks! That did it. 🎉

[mbennette68]

I'm happy to report that [latest-linux-intel] automated test build (beta) Pre-release works smoothly on my ThinkPad X1 Debian trixie testing with GNOME 47and Wayland :)

I've also confirmed that, "Thorium-3.1.0-alpha.1.12236290030.AppImage" works on Pop!_OS 22.05 LTS with none of the ill effects of previous versions. Hopefully a stable version will be released soon.

:)

[HelenePETIT]

I'm happy to report that [latest-linux-intel] automated test build (beta) Pre-release works smoothly on my ThinkPad X1 Debian trixie testing with GNOME 47and Wayland :)

I am under debian12, gnome 43.9, X11.
unfortunately this version v3.1.0-alpha.1.12708798077 does not recognize my LCP password and says :"the entered passphrase is wrong"
version 3.0.0 does recognizes correctly this same password.

What could i do ?
Thanks !

[danielweck]

hello, LCP-protected publications can be opened by official "stable" releases (the most recent being Thorium v3.0.0). LCP is not supported in the alpha / test builds which are deployed automatically from the develop branch (i.e. latest "unstable" code revision). Sorry.

[HelenePETIT]

hello, LCP-protected publications can be opened by official "stable" releases (the most recent being Thorium v3.0.0). LCP is not supported in the alpha / test builds which are deployed automatically from the develop branch (i.e. latest "unstable" code revision). Sorry.

thanks !

[twistios]

The SUID sandbox helper binary was found, but is not configured correctly.

I had this problem with Thorium 3.0.0 .deb-file on Kubuntu (Ubuntu 24.04).
The workaround (that worked for me) can be found here in step 2.
Obviously the path for electron has to be replaced with the path to Thorium (for example /opt/Thorium/chrome-sandbox)

Edit: So this is kind of the same as #2519 (comment).

[bmgzz]

https://github.com/edrlab/thorium-reader/issues/2519[](url)

[Asherathe]

I am using Thorium 3.0.0 AppImage on OpenSUSE Tumbleweed and Gnome 46.

Since starting to use this version I have noticed that loading an epub file is taking a very long time. I have tried several files that worked well on previous versions so can discount the files themselves.

I'm also running Thorium 3.0.0 on Tumbleweed, with XFCE, and I also find that books load ridiculously slowly. I sit here and stare at the screen for several minutes waiting for EACH page to load. This program is currently unusable to me.

[danielweck]

hello, have you tried the more recent 3.1 test releases?

[Asherathe]

I'm reading an LCP-protected file. I thought the test versions didn't work with them.

[danielweck]

the issue occurs with any EPUB, DRM-protected or not.
if the issue doesn't occur at your end when using the latest build with a non-LCP EPUB, then we can confidently assume that the bug is fixed (new Electron version since Thorium 3.0.0)

[Asherathe]

Oh, I see. Yes, that does fix it. Thanks.

[danielweck]

Electron Builder v26 is at pre-release stage, let's hope it is ready in time for Thorium 3.1
https://github.com/electron-userland/electron-builder/releases

There will be support for Linux AppArmor configuration (this should fix the chrome-sandbox SUID problems).
electron-userland/electron-builder#8636

Side note: there will also be built-in support for Electron Fuses, I will need to migrate our current build script.
electron-userland/electron-builder#8588