Ciao Andrea,

To the list: Andrea is a friend and a collegue, I'm helping him starting
using Guix as a package manager.

Andrea: next time when reporting bugs on Guix please mention you are
using it on a foreign distro (not as Guix System), in your case Debian.

Andrea Rossi via Bug reports for GNU Guix <bug-guix@gnu.org> writes:

> after the installation of ungoogled-chromium I tried to run it,
> receiving this message:
>
> [20998:20998:1126/122306.639343:FATAL:zygote_host_impl_linux.cc(117)] No
> usable sandbox! Update your kernel or see
> https://chromium.9oo91esource.qjz9zk/chromium/src/+/master/docs/linux/suid_sandbox_development.md
> for more information on developing with the SUID sandbox. If you want to
> live dangerously and need an immediate workaround, you can try using
> --no-sandbox.
>
> Maybe I'm missing something, or is the case of a proper bug?

In Jan this year I had the same issue, reported in help-guix, on Debian
as foreign distro and Marius Bakke [1] helped me solve it:

1. sudo sysctl -w kernel.unprivileged_userns_clone=1
2. sudo su -c "echo 'kernel.unprivileged_userns_clone=1' > /etc/sysctl.d/00-local-userns.conf"

This is because (ungoogled-)chromium sandbox relies on user namespaces
support in the kernel but Debian [2] disables user namespaces by
default, the above commands enables them for your current boot session
and permanently for next reboots.

Andrea please try the above fixes and tell us if they solve your issue.

Ciao, Gio'


[1] https://lists.gnu.org/archive/html/help-guix/2020-01/msg00059.html

[2] Chromium on Debian uses an alternative sandboxing method that relies
on a setuid binary, Guix do not use this :-)

-- 
Giovanni Biscuolo

Xelera IT Infrastructures