New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Unable to run sandboxed process when run as elevated under applocker #122951
Comments
|
(Experimental duplicate detection) |
|
Which specific insider build are you on? Please share the commit number. This should be in the about panel |
|
Here you go: Version: 1.56.0-insider (user setup) |
|
Thanks. Unfortunately I can't reproduce this issue with that build Can you try launching VS Code by running |
|
Based on the error message 1) and 2) are satisfied, very likely we are hitting 3) given the Lets check the webview devtools console log for any script errors thrown, if not we would have to expose a way to pause serviceworker execution on start to debug further, a similar feature provided by |
|
I see this stack appear before the error message: I'm not sure if this is a Markdown-specific issue though. I can also try uninstalling and re-installing if you'd like. |
|
Interesting, this looks a lot like the #120157 I saw earlier but then could not reproduce anymore. |
|
@moward It happens for all webviews though, not just markdown previews, correct? |
|
Image file previews are also broken. Do these use WebViews? I see an empty window but no error notification and don't see anything in the verbose logs. Also, I just upgraded a different machine to 85f8ebf and am now seeing the same problem there. |
|
I have noticed this issue on the stable build of 1.56.0 that was just released. I have found it only happens if I run vscode as administrator. I noticed because I couldn't read the release notes Error loading webview: Error: Could not register service workers: TypeError: Failed to register a ServiceWorker for scope ('vscode-webview://vs_code_release_notes/') with script ('vscode-webview://vs_code_release_notes/service-worker.js?platform=electron&id=vs_code_release_notes&vscode-resource-origin=https%3A%2F%2Fvs_code_release_notes.vscode-webview-test.com'): ServiceWorker cannot be started. |
|
You're absolutely right, @haugerbr. I always run as administrator and forgot to consider that. I just tried running without elevated permissions and the WebViews work |
|
@mjbvz I am an admin on the machine itself and vscode was installed through the windows installer. I am actually unable to open developer tools which is unfortunate because I was trying to get a better error message for you if one exists. I also tried submitting a bug though a non admin vscode instance so there would be more system information but I couldn't get it to post to github. |
|
@haugerbr can you launch with |
|
@deepak1556 the |
Are you also unable to open devtools with the flag ? Just to confirm, did you make sure any open instances of vscode was exited before performing the above operation ?
This is indeed related to webview management but it is very likely just a side-effect of the actual bug which we haven't deduced yet. Can you also provide the output of |
|
For me using |
@StanKirilov Can you run with |
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
|
@StanKirilov is at MS, so we can ask for more detailed logs/traces if needed. @deepak1556 What would help us investigate this issue? |
|
Hi, Version: 1.69.0-insider (system setup) running elevated
Version: 1.69.0-insider (user setup) running elevated
Version: 1.69.0-insider (user setup) running non-elevated
Version: 1.69.0-insider (user setup) running elevated with --no-sandbox
Hope this helps. |
|
This is helpful info, thanks @JustGuybrush . Running as elevated under applocker is not supported by the runtime, refs: https://bugs.chromium.org/p/chromium/issues/detail?id=740132. There seems to be a workaround implemented in the Edge browser https://textslashplain.com/2021/01/07/sandboxing-vs-elevated-browsing-as-administrator. If others in this issue are also running under similar setup then we will have to think about backporting the workaround for VSCode. |
|
Thanks @deepak1556. Sadly, AppLocker is mandatory in my company. |
|
@JustGuybrush in #122951 (comment) you had also tried to run the application as non-elevated. Is it not possible to use this mode by default ? Can you also provide context on why the application needs to be launched as elevated ? |
|
I use vscode to develop and debug PowerShell scripts. And because of AppLocker, PowerShell is run in Constrained Language Mode, disabling a lot of needed features. https://devblogs.microsoft.com/powershell/powershell-constrained-language-mode/ |
|
I am also getting this error when trying to preview markdown with the new Visual Studio Code Server with Seems to work fine when running the server on macOS but getting this error when running on Ubuntu. |
I encountered this problem after upgrading vscode server and solved it by killing all existing vscode-server processes and restarting vscode all over. In my case, this seems to be related to some conflicts between the upgrade operation and the previous processes. |
|
@deepak1556 I get the following error when trying to launch the insiders build as an administrator. |
|
Same issue on Ubuntu VSCode |
|
@elvinagam - did you try closing all vscode instances as noted here? For me, |
|
@jcward thanks for the heads up. Looks like one has to close/restart all VSCode instances to make it work. Feels weird.. |
|
Just had this issue. I closed two code windows, then quickly opened up another one that had a markdown preview already open and was unable to load the preview exactly like issue 128649. I closed the preview, opened a new one, same issue. Restarted code a few times, same error. Finally I closed Code, ran I'm on Ubuntu 22.04, installing from the |
|
In our company we have VSCode installed on networkdrive . Without --no-sandbox parameter VSCode won't start at all, even from context menu. It's a good workaround if it's possible to put the parameter in argv.json. |
|
Wy not add 'no-sanbox' to SUPPORTED_ELECTRON_SWITCHES? We cann not run VSCode (windows) installed on networkdrive without --no-sandbox... Is a some issue or not? It is possible to fix VSCode (sandboxed) to run from networkdrive? |


Steps to Reproduce:
The same thing happens for other WebViews, like opening an extension from the Extensions sidebar, or using the "Issue Reporter".
Does this issue occur when all extensions are disabled?: Yes
The text was updated successfully, but these errors were encountered: