Restore the Linux security sandbox

Why you are seeing this

Lyre can start with Chromium’s --no-sandbox fallback when Linux user namespaces are unavailable and the installed chrome-sandbox helper cannot run. The warning banner and the Diagnostics row describe this launch only; they are not proof that the next launch is affected the same way.

Dismissing the banner hides it for the current launch. It does not enable a sandbox, and it reappears on the next launch if the underlying cause is still present.

Check the reason

Open Settings → Diagnostics → Linux security sandbox (also shown under Settings → Permissions on Linux). The reason and LINUX_SANDBOX_DISABLED code describe what the launcher found. An explicit --no-sandbox argument or PASEO_ELECTRON_FLAGS override also disables the sandbox; remove that override and restart.

Enable user namespaces

Ask your Linux administrator to enable unprivileged user namespaces and permit Chromium to create a user and network namespace. Distribution policy, AppArmor, containers and system-wide namespace limits can each block this. Test with unshare --user --map-root-user --net true in a terminal. If it fails, use your distribution’s supported policy instructions; do not weaken unrelated restrictions blindly.

Use the installed SUID helper

A Linux package installation may use the bundled chrome-sandbox helper when namespaces are unavailable. It must be owned by root, have mode 4755, and live on a filesystem mounted without nosuid. The installer configures those properties for supported packages. If they changed, reinstall the package or ask an administrator to repair that installation. A portable or extracted copy should normally use user namespaces instead. Do not set SUID on an unverified file.

Verify

Quit and reopen Lyre, then return to Diagnostics. The row should say Ready and the warning should disappear. If it still says Disabled, share the reason and diagnostic code from Diagnostics in your report; see share a useful report.