Remote Debugging ChromeOS Kiosk Apps and Progressive Web Apps in Kiosk Mode

Preface and prerequisites

This article is intended for developers interested in remotely debugging their ChromeOS App or Progressive Web Application running in Kiosk mode.

The target ChromeOS device must be in developer mode, and enrolled into an admin console Organization Unit (OU) with forced re-enrollment and verified boot disabled. If it was previously used with forced re-enrollment (FRE) enabled you’ll need to do the steps below.

Forced re-enrollment can be found in the Chrome device settings in your Google Admin console. When this is set to ‘Device is not forced to re-enroll after wiping’, it will disable forced re-enrollment and allow developer mode to be enabled.

Remove ChromeOS device from forced re-enrollment

Move device to OU with FRE and verified access/boot disabled
Reboot with the recovery button depressed, then attempt to enter developer mode with Ctrl + D. You will not be able to enter developer mode, but the device will factory reset itself.
Run through initial setup, the device should not automatically re-enroll, if it does, check your admin console settings and ensure the device is in the correct OU.
Log into the device in consumer mode, do not enterprise enroll the device.
Reset the device again with the recovery button, you should be able to enter developer mode using Ctrl + D shortcut.
Device should be in developer mode now, you can enable debugging features and enterprise enroll the device.

https://chromium.googlesource.com/chromiumos/docs/+/master/developer_mode.md

Remove rootfs verification

You will need to open a shell on the target Chromebox by either opening a virtual terminal by pressing Ctrl + Alt + F1(back arrow) or you can skip kiosk app on startup with Ctrl + Alt + S, log in, and open a shell by pressing Ctrl + Alt + T and typing ‘shell’

Run the following command:

$ sudo /usr/share/vboot/bin/make_dev_ssd.sh –remove_rootfs_verification

You’ll be prompted to run the command again with the booted partition. e.g.

$ sudo /usr/share/vboot/bin/make_dev_ssd.sh –remove_rootfs_verification –partitions 4

Reboot the device.

Enable SSH access

Install sshd startup files.

$ /usr/libexec/debugd/helpers/dev_features_ssh

Allow password access for root user in either a virtual terminal, or by changing to the root user.

$ passwd

Enable remote debugging

Add –remote-debugging-port startup flag to chrome_dev.conf e.g.

$ sudo vi /etc/chrome_dev.conf

Add ‘–remote-debugging-port=9222’ to a new line at the end of the file

Chrome device IP address

Take note of your Chrome device’s IP address using system settings, or by using ifconfig command.

$ ifconfig eth0
$ ifconfig wlan0

You’re now done with the target device, reboot and allow the device to start in kiosk mode.

SSH Client and port forwarding

On your other computer, open your favorite SSH client that allows port forwarding, this can be done in ChromeOS using the Secure Shell extension.

https://chrome.google.com/webstore/detail/secure-shell/iodihamcpbpeioajjeobimgagajmlibd

Configure your SSH Client with:

User: ‘root’
Host: IP of Chromebox
Port: 22
SSH Arguments: ‘-L 9222:localhost:9222’. (-L argument forwards a remote port to a local port. If you used a port other than 9222, replace it here)

Note: If you have used SSH with the same host, you may need to clear the host from your known_hosts file in the ssh client settings, or append ‘-o UserKnownHostsFile=/dev/null’ to the SSH arguments to use an empty known_hosts file.

You’ll be prompted to add the host/key to your known hosts.