[PM-8395] [POC] Introduce wrapper script to prevent renderer coredumps in desktop linux (#9395)

* Add wrapper script to protect from coredumps and re-enable process reload

* Allow args passthrough and clean up after-pack script

apps/desktop/electron-builder.json

@@ -12,6 +12,7 @@
     "app": "build"
   },
   "afterSign": "scripts/after-sign.js",
+  "afterPack": "scripts/after-pack.js",
   "asarUnpack": ["**/*.node"],
   "files": [
     "**/*",

apps/desktop/resources/memory-dump-wrapper.sh

@@ -0,0 +1,8 @@
+#!/bin/sh
+
+# disable core dumps
+ulimit -c 0
+
+APP_PATH=$(dirname "$0")
+# pass through all args
+$APP_PATH/bitwarden-app "$@"

apps/desktop/scripts/after-pack.js

@@ -0,0 +1,26 @@
+/* eslint-disable @typescript-eslint/no-var-requires, no-console */
+require("dotenv").config();
+const path = require("path");
+
+const fse = require("fs-extra");
+
+exports.default = run;
+
+async function run(context) {
+  console.log("## After pack");
+  console.log(context);
+  if (context.electronPlatformName === "linux") {
+    console.log("Creating memory-protection wrapper script");
+    const appOutDir = context.appOutDir;
+    const oldBin = path.join(appOutDir, context.packager.executableName);
+    const newBin = path.join(appOutDir, "bitwarden-app");
+    fse.moveSync(oldBin, newBin);
+    console.log("Moved binary to bitwarden-app");
+
+    const wrapperScript = path.join(__dirname, "../resources/memory-dump-wrapper.sh");
+    const wrapperBin = path.join(appOutDir, context.packager.executableName);
+    fse.copyFileSync(wrapperScript, wrapperBin);
+    fse.chmodSync(wrapperBin, "755");
+    console.log("Copied memory-protection wrapper script");
+  }
+}

apps/desktop/src/main/window.main.ts

@@ -53,11 +53,9 @@ export class WindowMain {
       this.win.setBackgroundColor(await this.getBackgroundColor());
 
       // By default some linux distro collect core dumps on crashes which gets written to disk.
-      if (!isLinux()) {
       const crashEvent = once(this.win.webContents, "render-process-gone");
       this.win.webContents.forcefullyCrashRenderer();
       await crashEvent;
-      }
 
       this.win.webContents.reloadIgnoringCache();
       // FIXME: Verify that this floating promise is intentional. If it is, add an explanatory comment and ensure there is proper error handling.