Chromium download error

[beavers]

After a recent update on -current, Chromium no longer lets me download files:

Could not read the contents of user

Error opening directory '/home/user': Permission denied

Permissions on that directory haven't changed. Anyone else seeing this behavior?

[jggimi]

For -current users, --enable-unveil was enabled by default on November 17. You can revert to prior operation by disabling the security feature. Run chromium with "--disable-unveil".

[Head_on_a_Stick]

Originally Posted by beavers

Chromium no longer lets me download files

If you pre-set the download destination to ~/Downloads then Chromium should be able to save stuff there even with unveil(2) enabled.

[brudan]

I'm on OpenBSD 6.5. My ~/Downloads is a symlink to a directory on a separate harddrive and it seems unveil is preventing chromium from following the link.

I want to enjoy the added security of unveil, but would like chromium to be able to follow the symlink to my Downloads directory. Please, how do I accomplish that?

Also, what if I want ~/.config/chromium to also be a symlink? Would it be too complicated to allow that, too?

(I cannot make much of the unveil(2) man page.)

[jggimi]

You cannot defeat unveil restrictions with symbolic links. I perceive your options are:

1. Move the user's $HOME to the other drive.
2. Create mount points on the other drive for $HOME/{Downloads,.config/chromium}
3. Run with unveil disabled.
4. Use a different browser.

[brudan]

Thank you, jggimi. Sounds like unveil does not have a whitelist feature (similar to mechanism in firejail for linux). Pity. That would have been the easy fix I was hoping for.

Does OpenBSD have something similar to Linux's 'mount --bind'? If so, I can't seem to find it--but if it does, I could bind-mount the external ~/Downloads and ~/.config/chromium directories to my home folder. That would be a nice solution.

[jggimi]

No, there's no equivalent.

[brudan]

I found this: https://dataswamp.org/~solene/2018-0...ount-bind.html
I tested and it has the same effect as a bind mount, but is too complicated for my taste.

I guess I'll either use chromium with unveil disabled or else will just stick with firefox.

Thanks a bundle, as always. You are always a great help.

[jggimi]

Unveil symbolic link functionality is subject to possible future revision, per the BUGS section of the unveil(2) man page.