M117+ removes the 'sudo' command.

[DennisLfromGA]

Chrome version M117+ removes the sudo command which brings up some questions for the continued use of crouton.

When entering a crosh shell session we now get the following message:

Sudo commands will not succeed by default.
If you want to use sudo commands, use the VT-2 shell
(Ctrl-Alt-{F2/Right arrow/Refresh}) or build the image with the
login_enable_crosh_sudo USE flag:

$ USE=login_enable_crosh_sudo emerge-$BOARD chromeos-login
or
$ USE=login_enable_crosh_sudo cros build-packages --board=$BOARD

Although not yet possible with Chrome beta version 117.0.5938.22, the above alludes to the possibility of still being able to run the sudo command in the VT-2 shell, let's hope that comes to fruition.

So, for the time being, short of rebuilding the board image with the flag(s) mentioned above, we can no longer run crouton as user 'chronos' in a crosh shell or the VT-2 shell, when attempting to do so the following message is displayed when invoking the sudo command:

sudo: The "no new privileges" flag is set, which prevents sudo from running as root.
sudo: If sudo is running in a container, you may need to adjust the container configuration to disable the flag.

I guess some of the foremost questions are:

1. Can we / Should we run crouton as root or even chronos in the VT-2 shell?
2. If we run crouton in the VT-2 shell will the GUI desktops still launch & work?
3. Is crouton still a viable way to run Linux distros in a chroot or should we move to Crostini and stop using crouton?

I think once Chrome version M117 lands in the stable channel, currently scheduled for Tue, Sep 19, 2023, we'll all be facing these issues.

-DennisLfromGA

[dnschneid]

Yeah, that's really unfortunate. Hopefully they actually enable sudo in VT-2. I can't find any public bugs on it, so if you file or discover one, please share a link.

1. You will be able to enter a crouton shell from VT-2, but native graphical sessions will be difficult, as you suspected.
2. The difficulty with VT2 is due to the way Chromium and frecon hand off control of the display -- we can ask Chromium to release the display but there's no equivalent interface for it in frecon. There was discussion a long time ago to add that, but as far as I can tell that never materialized. Launching a xiwi graphical session might just work. Launching a native graphical session will likely work if you run sshd in your chroot from VT2 and then SSH from Chromium OS to launch your desktop environment. You could even make a profile in Secure Shell that just runs the start[whatever] command.
3. I recommend using crostini if it can do what you need it to do. The feature disparity is always shrinking, and crouton is slowly(?) bitrotting due to Chromium OS's constant development.

[DennisLfromGA]

@dnschneid

Hopefully they actually enable sudo in VT-2. I can't find any public bugs on it, so if you file or discover one, please share a link.

Nothing public yet, the only thing I saw was this statement added to the crosh shell invocation:

"If you want to use sudo commands, use the VT-2 shell"

Also, mr.chromebox evidently made some progress with it, he mentioned this on his Discord server:

"I got Google to fix it but who knows how long it will take to propagate."

-DennisLfromGA

[darrell-k]

@dnschneid

2. Launching a native graphical session will likely work if you run sshd in your chroot from VT2 and then SSH from Chromium OS to launch your desktop environment.

This works. After installing openssh-server I needed to create directory /run/sshd.

For anyone looking for a guide to get back their GUI Crouton:

1. <Ctrl><alt><refresh> to open VT2 (a full screen terminal)
2. log in as chronos (no password unless you've previously created one)
3. sudo apt install openssh-server
4. sudo mkdir /run/sshd
5. sudo /usr/sbin/sshd
6. <Ctrl><alt><back arrow> to return to Chrome gui
7. in the crosh shell: ssh <user>@localhost where <user> is your Crouton user and then at the new prompt, startxfce or startgnome or whatever.

Edit: originally I had step 7 as "in the crosh shell: ssh localhost ..." which was wrong: you need to specify the user you created for Crouton, otherwise ssh will try to connect as the current user, chronos, which does not exist in your chroot.

I really don't know what Google was thinking of with this change: anyone who has gone to the trouble of enabling developer mode and installing crouton (or anything else that requires root) obviously wanted to do it. I think they've always said they won't support developer mode problems, so why not leave it at that?

Looks like someone at Google decided to solve a problem that didn't exist, and in doing so stripped functionality from people (like me) who would never have bought a Chromebook if it wasn't for Crouton. It's all very well saying use Crostini, which I do for some things, but it's slow on low spec machines and it's quite possible to hard-lock the machine if you try to do too much.

Rant over.

[CroutonIsFun]

Ahhh, yeah, my mistake, I was thinking Esc-Refresh-Power.

I have the same 3 VT's as you do. Ha! I learned something new today!

[darrell-k]

There's a mistake in my instructions above:

ssh localhost should be ssh <user>@localhost (where is the user you created for Crouton). Sorry if this wasted anyone's time.

@CroutonIsFun has written an excellent wiki page which deals with this issue here: https://github.com/dnschneid/crouton/wiki/Crouton-Quick-Start

[Fazzuliyat]

Anyway to scroll up on VT2 (a full screen terminal) ?

[CroutonIsFun]

No

[Chromebooktwo]

Now I know I a bit late (2024 oct) but I am pretty sure if you do shift + up or down arrow keys you can scroll, let me check - just checked, it works!

[CodeThePeace]

@dnschneid thoughtfully wrote:

I really don't know what Google was thinking of with this change: anyone who has gone to the trouble of enabling developer mode and installing crouton (or anything else that requires root) obviously wanted to do it. I think they've always said they won't support developer mode problems, so why not leave it at that?

Looks like someone at Google decided to solve a problem that didn't exist, and in doing so stripped functionality from people (like me) who would never have bought a Chromebook if it wasn't for Crouton. It's all very well saying use Crostini, which I do for some things, but it's slow on low spec machines and it's quite possible to hard-lock the machine if you try to do too much.

My reply begins:
I'm reluctant to comment, particularly as I haven't solved the issue yet. I basically agree with dnschneid, but I have a slightly different take on the issue even though my situation is somewhat typical of people who have been posting on the forums about the sudo command not succeeding by default.

The chromebook updated automatically, and with the next restart, sudo wasn't working. I use bash in a chroot container. Occasionally, I use the Ubuntu desktop, because it gives me simple access to X11 apps. I am able to switch to a VT-2 shell, and switching to root does work in the developer console. I am able to get some functionality from the chroot container, but I can't access the Ubuntu desktop or the X11 apps. I've only been working on this problem for a week, and I am surprised to read that people have been trying to solve this for over a month.

Where my view differs slightly from dnschneider is that, it is not only the people that are using crouton who are affected by the "deprecation" of sudo, but anyone using any terminal emulator on the chromebook, will discover that bash is essentially not functional.

I can't understand the logic, because it seems to me that Sudo itself is a security measure that has probably been around for 75 years. As my AI constantly reminds me, it is dangerous to let other processes run as root and use sudo. And you would have to agree, you can't just let anyone use sudo. So, maybe the thinking was that eliminating sudo was just the security measure that was needed for the update. Well, it was nice that we got a message of the day telling us that the sudo privileges need to be set with two cumbersome options on building the image.

[CroutonIsFun]

There is nothing wrong with crouton. MrChromebox says crouton is "deprecated" (see here) but he doesn't get to decide what I run on my own Chromebook. As long as you can use sudo in VT-2, then the "problem" is solvable.

There is nothing illegitimate about using crouton. It still does what it was intended to do, and I appreciate the thought which went into to creating this amazing script.

I wonder if we should refer to 3 virtual terminals:

Ctrl-Alt-F2 = VT-2
Ctrl-Alt-F3 = VT-3
Ctrl-Alt-F4 = VT-4

[Spiderkid2013]

i just realized that there are 2 VTs

[Apocalypse10110]

Can someone help me install Crouton in 2024. I have read through dozens of articles but that has made me even more confused.

[CroutonIsFun]

Updated Instructions

[YeesterPlus]

just use chromebrew and run crew install crew-sudo; bash ~/.bashrc in VT2-4

[CroutonIsFun]

@DennisLfromGA @dnschneid @drinkcat

crouton is no longer installable at all - - - some weird error about a read-only file system. I can't copy and paste it because in VT-2 there is no way to do this.

All I was trying to do was install a core, with sudo crouton -r focal -t core

This also doesn't work with xenial: sudo crouton -r xenial -t core

You cannot even get beyond this step: nothing downloads.

[dnschneid]

please give #5056 (comment) a try

[CroutonIsFun]

Thank you for the tip. The rwsec branch allows files to download, but the install fails at the point of creating /var/run/crouton/...

Executing the command sudo mount -o remount,rw /sys/kernel/security/ seems to do the trick. Since this needs to be done after each reboot, I've created an alias to do this for me.

I'm in the process of installing the LXDE desktop for release focal fossa. I'll let you know how it goes.

I had resigned myself to using Crostini, and dual booting. So, I had installed deluge in crostini so I could download a torrent from Xubuntu. But every time I attempted to copy the downloaded iso to the ChromeOS Downloads folder, the /mnt/chromeos folder in Crostini got corrupted. And the only way to fix it was to delete Crostini and set it up again.

Thanks for jumping in. ~James

Edit: The remount command did the trick. I have a fully operating desktop now.

[CodeThePeace]

Will wonders never cease? I can't access my crouton either. I'm going to try the update, and will report back if it works.

…

On Fri, May 10, 2024 at 3:28 PM CroutonIsFun ***@***.***> wrote: @DennisLfromGA @dnschneid @drinkcat crouton is no longer installable at all - - - some weird error about a read-only file system. I can't copy and paste it because in VT-2 there is no way to do this. All I was trying to do was install a core, with sudo crouton -r focal -t core — Reply to this email directly, view it on GitHub, or unsubscribe. You are receiving this because you commented.Message ID: ***@***.***>

[CodeThePeace]

correction, I can't access my chroot. The files are fine. /usr/local/bin/mount-chroot 362 cannot create /sys/kernel/security/chromiumos/inode_securitiy_policies/allow_fifo: Read only file system. Well, the permissions of the directory allow_fifo are set at 200, and trying to modify the permissions alerts me to the conditions of a Read only file system. this can't be on the chip, because we just had an update..... Gosh this can't be since last March 8, 2024, as per this discussion. #5056 and closed as not planned? I seem to remember trying to remount, but finding a mount point was difficult if not impossible. I can find no information on BRANCH=rwsec On Fri, May 10, 2024 at 4:11 PM Benjamin Godfrey ***@***.***> wrote:

…

Will wonders never cease? I can't access my crouton either. I'm going to try the update, and will report back if it works. On Fri, May 10, 2024 at 3:28 PM CroutonIsFun ***@***.***> wrote: > > @DennisLfromGA @dnschneid @drinkcat > > crouton is no longer installable at all - - - some weird error about a read-only file system. I can't copy and paste it because in VT-2 there is no way to do this. > > All I was trying to do was install a core, with sudo crouton -r focal -t core > > — > Reply to this email directly, view it on GitHub, or unsubscribe. > You are receiving this because you commented.Message ID: ***@***.***>

[CroutonIsFun]

sudo mount -o remount,rw /sys/kernel/security/

The new branch doesn't completely solve the problem. The above command should make it possible.

[CodeThePeace]

Changing the mount point does seem to work to a certain extent, but... $ sudo enter-chroot Entering [stately partition ]... chroot failed to run command 'su': Permission denied WARNING: starting chroot system dbus daemon failed with code 126 chroot failed to run command 'su' : Permission denied Unmounting [stately partition ].... Here is the discussion from 9 years ago about the error code 126: #1751 and we are back at square one. The answer is to Redownload everything....which puts us in a loop. Error 126 means the command exited due to receiving an invalid argument. The su isn'r running because either we are bypassing the su instructions or because the sudo itself is corrupted or lacking a dependency library.

…

On Fri, May 10, 2024 at 5:06 PM CroutonIsFun ***@***.***> wrote: Thank you for the tip. The rwsec branch allows files to download, but the install fails at the point of creating /var/run/crouton/... Executing the command sudo mount -o remount,rw /sys/kernel/security/ seems to do the trick. Since this needs to be done after each reboot, I've created an alias to do this for me. I'm in the process of installing the LXDE desktop for release focal fossa. I'll let you know how it goes. I had resigned myself to using Crostini, and dual booting. So, I had installed deluge in crostini so I could download a torrent from Xubuntu. But every time I attempted to copy the downloaded iso to the ChromeOS Downloads folder, the /mnt/chromeos folder in Crostini got corrupted. And the only way to fix it was to delete Crostini and set it up again. Thanks for jumping in. ~James — Reply to this email directly, view it on GitHub, or unsubscribe. You are receiving this because you commented.Message ID: ***@***.***>

[CroutonIsFun]

All I can suggest is deleting all the chroots and starting over. Before you do, reboot, and then, before you do anything else, execute the remount command. I'm not sure what you mean by changing the mount point, I'm not doing anything like that.

[CroutonIsFun]

So now, multiple hacks are needed to install and use Crouton:

1. Execute the remount command
2. From VT-2, install Crouton, install a chroot, enter the chroot, and start ssh.
3. From the crosh shell, ssh into your chroot, then launch the desktop using a start command.

This is so far removed from the original instructions that there is no way a newcomer can figure out what to do.

And as issue after issue continues to be filed, it's really hard to explain to someone how to fix it. Any suggestions? Is it possible to re-write the instructions?

[dnschneid]

Probably the best thing to do for now is make a very short and succinct wiki page with the latest instructions, and I'll link to it from the README

[CroutonIsFun]

@dnschneid

Sorry for the delay. I just saw your reply. Kindly checkout this wiki page. I was as brief as possible, but some things beg for an explanation. There is nothing "weird" here: i.e., no using Chromebrew or other esoteric means to re-enable sudo in the crosh shell, etc.

Updated Crouton Installation Instructions

Note: in my testing, the command sudo /etc/init.d/ssh start does nothing. I was testing in xenial. Next, I will test in focal. I'm very confused at this point.

@dnschneid

Edit: There seems to be no way to start ssh in xenial. Therefore, in the updated instructions, I used focal as an example, and state that xenial no longer works correctly. In my experience, both focal and bullseye can work well; of the two, focal seems to have fewer glitches, and has become my preferred release.

[darrell-k]

You could put /etc/init.d/ssh start in /etc/rc.local to avoid having to run the command each time you start a chroot.

[CroutonIsFun]

Yes, I know that. My intention was to provide a concise set of updated instructions. There are several things which can be done to simplify things once a basic setup has been accomplished. I wrote this new wiki for @dnschneid ; when/if he approves, then I may write a sort of appendix and link to it from the updated instructions.

[CroutonIsFun]

The situation now is ludicrous! I cannot get xenial working without enabling sudo in the crosh shell using Chromebrew or some other method: and xenial is a "supported" release...

And yet, focal works great, I can launch ssh in the chroot and ssh to it from the crosh shell: and focal is an "unsupported" release, which you have to wait 30 seconds before installation continues...

And basically, crouton itself is nearly unsupported, as it's "maintenance only", but there's really no maintenance to speak of. To answer the question, Yes, we can continue using crouton, as long as community members keep coming up with clever ways to make it work.

And if I sound aggravated, well, I am. Why can't we at least make focal a supported release? If I knew enough, I'd fork it myself and setup shop, but I haven't reached that level yet. Thanks to David, Dennis, Nicholas and others who have contributed over the years.

James :)

[dnschneid]

I'll remove the 5 second wait (which can feel like 30 seconds), because you're right, at this point no release is fully "supported". During crouton's heyday when we had a test lab, supported releases were passing every test on every target across a wide variety of Chromebooks across different architectures.

The reason for my hesitation to make dramatic changes to support the fast-moving Chromium OS is that ultimately, as Chromium OS advances, crouton is needed less and less on modern Chromebooks. But there are a massive number of EOL Chromebooks that do not get updates, and for them, I want to be certain that crouton will always work. Without a test lab, it's very tricky to make tweaks to support the new Chtromium OS quirks without causing regressions on the machines that are frozen in time. It's why the silence branch hasn't been merged -- even if we can't get modern cras working, I do not want to defeature EOL Chromebooks that have no other options.

So you have my sincere gratitude for continuing to push through all the roadblocks that modern Chromium OS has been introducing, and for taking the time to share your knowledge with the community. I'll continue to integrate the workarounds into crouton that I'm convinced won't impact EOL devices, but larger changes will require someone to step up to do some very careful coding and testing. So far nobody has stepped forward to do that, so for now the best we can do is make the workarounds discoverable.

edit: nvm, found the 30 second delays you're probably hitting. I'll reduce those too

[CroutonIsFun]

Edit: I agree, you need to leave the base Crouton alone! Then, if and when someone comes along who has the expertise to "fix" Crouton, you still need to leave the base code alone, so it doesn't break for EOL devices.

Basically, someone needs to fork Crouton and create a new version.

---

Thank you for your kind words! I was contemplating the situation earlier today, and thinking that crouton is only a single ChromeOS update away from being completely broken. Meanwhile, for me, it's great fun playing this cat and mouse game.

I've learned a lot. I already "knew" Linux, but I have learned so much, and crouton has brought such fun and excitement to my Chromebook experience.

Crouton rocks!!!

[CroutonIsFun]

And now, last but not least, the crouton extension is being deprecated. Have you seen the flag on the extension in the web store? Well, it's not there at the moment, but there was a notice it may be removed because it doesn't conform to certain standards. Weird. It was there just an hour ago.

I've moved on to dual booting when I can't do something in Crostini.

[DennisLfromGA]

[CroutonIsFun]

That's it!!!

[DennisLfromGA]

Yup, @dnschneid mentioned it a while back:

• crouton extension and manifest v3 #5035

-DennisLfromGA

[CroutonIsFun]

Yup, @dnschneid mentioned it a while back:

• crouton extension and manifest v3 #5035

-DennisLfromGA

Ahhh, I failed to connect the dots. I even commented on his post :-(

In my ChromeOS browser, UBO still works. UBO Light is available, but I'm keeping the original until Google kills it.

[CroutonIsFun]

I had spent 2-3 hours carefully setting up a chroot, it was working well, then I updated my Chromebook. I'm on extended support, so I had to give up my Play Store Apps. No big deal. But after the reboot, when I tried to enter-chroot, I got an error, something like this:

Cannot create /var/run/stateful_partition/crouton/chroots/ yada yada yada

I'm sorry I don't have the exact wording. I'm now at version 126.0.6478.251 (Official Build) (64-bit), on the stable channel. I'm giving up after this. I'm going back to verified mode, and I'll be installing and using Linux (crostini).

End of the line for crouton, I think. It's been fun. :-)

[gamepier]

there is no apt installed on my vt-2 terminal

[CroutonIsFun]

No, the apt is inside your chroot, if you managed to set it up correctly.

[Zylk-dev]

This is honestly just annoying. Crouton is one of those little gems that makes a Chromebook worth it to so many people—it gives us the flexibility to actually make the device our own. Taking away sudo in M117 feels like a slap in the face to those of us who appreciate having that control. Sudo isn’t just some technical command; it’s what lets us experiment, customize, and actually push the limits of what these devices can do.

Why strip out something that people rely on and appreciate without a solid reason or alternative? It feels like ChromeOS is slowly chipping away at the things that made it fun and valuable for power users. It’s just disappointing to see the platform moving away from what actually made it special for so many of us.

I will say, I do love using Crostini on my newer Chromebook model—it’s really impressive. It covers almost everything I need, and sometimes it’s even more than enough. Crostini has brought a lot of flexibility and power that’s pretty much built right in, which I definitely appreciate. It doesn’t replace the charm and control of crouton completely, but it’s close. For what it’s worth, Crostini makes a solid case on its own, especially with each update pushing it forward.

[1926ar15]

Whenever I setup "Linux development environment", which I think is the same as "Crostini", it causes my Chromebook to run poorly.