Can't execute binaries inside the AppImage (when mounted) with sudo

[jviotti]

Hi, we're having a strange issue over here at Etcher, an image writer: executing any command as sudo from the AppImage once its mounted outputs command not found. The executable indeed has execution permissions for everyone, and it can be executed normally without sudo.

Maybe this is the expected AppImages behaviour but let me share our use case: The entry point of our desktop application makes the app execute as a desktop app or a CLI tool depending on the value of an environment variable, which is ELECTRON_RUN_AS_NODE. The actual writing functionality is implemented in the CLI version, the GUI forks itself with ELECTRON_RUN_AS_NODE=1 (causing the CLI to run as a child process) and the CLI version emits state information back to the parent.

Since writing to devices requires elevated privileges, the GUI forks itself using gksudo, pkexec or kdesudo, depending on what's found on the client's machine, however we get the above mentioned error when forking the AppImage entry point as sudo.

Is there a way to workaround this limitation?

[probonopd]

I think this has to do with how our FUSE mounting works.

One option would be to run the entire AppImage with sudo.

Another option might be to change the FUSE mounting (check the FUSE documentation for allow_other and allow_root). Haven't really tried that since so far I didn't have the need for it.

[jviotti]

I'm experimenting with adding the -o allow_other option in the runtime, however creating the AppImage from the AppDir outputs the following error:

fusermount: failed to open /etc/fuse.conf: Permission denied
fusermount: option allow_other only allowed if 'user_allow_other' is set in /etc/fuse.conf

Asking users to add such option to /etc/fuse.conf would obviously be a big no. Any ideas?

One option would be to run the entire AppImage with sudo.

This is what we do at the moment, but looks like its not a good practice to execute GUI applications as root, and it causes tons of problems with pkexec.

[probonopd]

Hmm. Unfortunately option allow_other only allowed if 'user_allow_other' is set in /etc/fuse.conf sounds to me like the fuse developers explicitly require root to enable this capability by editing a file only accessible by root. Sorry I have no idea around this at the moment. I could imagine mounting without the FUSE default nosuid could do the trick, however that seemingly also requires root rights to be enabled. So I am really a bit at a loss here right now.

Maybe the FUSE developers have an idea. (Ask the user to enter the root pw and then use that to remount the AppImage with the desired options?)

[jviotti]

Too bad to be stuck at this. I'll get in touch with the FUSE developers. Asking for the root password and remounting the image could be a decent way to go. Do you happen to know a way for the mounted appImage to determine its original location (the *.AppImage file)?

[probonopd]

Yes, check the $APPIMAGE environment variable.

[jviotti]

Awesome, I got it working that way. Still not perfect, but good enough for now.

[jviotti]

Hi @probonopd ,

How do you handle auto-unmounting of the appImage after its no longer needed? I'm struggling with this in the workaround recommended before when the application is killed with Ctrl-C. Is this something coming from FUSE automatically?

[probonopd]

FUSE should unmount as soon as the process and its subprocesses (AppRun) have exited.

[probonopd]

I do not know what to do about this. Feel free to reopen if the issue is still relevant.

[jviotti]

Sounds good, thanks a lot!