[BUG] Desktop (Linux): claude-desktop runs with no_new_privs, so sudo fails in its terminal and Snap apps (default browser) cannot be launched

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

On Linux, the claude-desktop process itself runs with the no_new_privs flag set. Every child inherits it (Code sessions, Bash tool, Terminal panel tabs) and it cannot be cleared. Two visible consequences:

1. sudo does not work in the app's Terminal panel. It worked there before my upgrade from Ubuntu 24.04 to 26.04 today.

2. Links do not open when the default browser is a Snap. "Report a problem" → "Continue on GitHub" silently does nothing. My default browser is the Snap Chromium (chromium_chromium.desktop); snap-confine needs elevated capabilities, which no_new_privs blocks. The app does not surface the failure, so for the user nothing happens.

Where the flag comes from (NoNewPrivs from /proc/<pid>/status, walking up from the terminal shell):

bash            NoNewPrivs 1
claude          NoNewPrivs 1
claude-desktop  NoNewPrivs 1   (/usr/lib/claude-desktop/claude-desktop, started directly by the session)
lxqt-session    NoNewPrivs 0

The launcher is plain Exec=claude-desktop %U, /usr/bin/claude-desktop is a symlink to the ELF binary (no wrapper), Seccomp is 0, and the AppArmor profile is profile claude-desktop ... flags=(unconfined) { userns, }. I found no setting for this.

Downgrading the app to 2.26454.2 and 2.19675.1 did not change anything, so the trigger is likely the OS upgrade (Ubuntu 26.04, kernel 7.0, sudo-rs as default sudo) rather than one specific app version.

What Should Happen?

Either the Terminal panel and spawned processes should not inherit no_new_privs (so sudo and Snap apps work as in a normal terminal), or, if it is intentional, the app should say so in the terminal / settings and offer a way out. External links should open even when the default browser is a Snap, or the failure should be shown to the user.

Error Messages/Logs

$ sudo ./backup.sh
sudo: The "no new privileges" flag is set, which prevents sudo from running as root.
sudo: If sudo is running in a container, you may need to adjust the container configuration to disable the flag.

$ /snap/bin/chromium --version
snap-confine is packaged without necessary permissions and cannot continue
required permitted capability cap_dac_override not found in current capabilities:
  cap_wake_alarm=i

Steps to Reproduce

1. Ubuntu 26.04.1 LTS (kernel 7.0), Claude Desktop 2.31226.0 from Anthropic's apt repo, started from the normal app launcher.
2. Open a Code session and its Terminal panel.
3. Run grep NoNewPrivs /proc/$$/status → 1. Run grep NoNewPrivs /proc/$(pgrep -o claude-desktop)/status → 1.
4. Run sudo true → fails with the "no new privileges" message.
5. Set a Snap browser as default (e.g. Chromium Snap), click "Report a problem" → "Continue on GitHub" in a Project thread → nothing opens.

Claude Model

None

Is this a regression?

Yes, this worked in a previous version

Last Working Version

Desktop app before upgrading Ubuntu 24.04 → 26.04 (same app versions worked then)

Claude Code Version

Claude Desktop 2.31226.0 (Claude Code 2.1.288)

Platform

Anthropic API

Operating System

Ubuntu/Debian Linux

Terminal/Shell

Other

Additional Information

• Ubuntu 26.04.1 LTS (upgraded from 24.04 today), kernel 7.0.0-38-generic, LXQt / X11
• claude-desktop 2.31226.0; also tested 2.26454.2 and 2.19675.1 (same result)
• sudo: sudo-rs 0.2.13 (/usr/lib/cargo/bin/sudo), sudo 1.9.17p2 also installed
• Default browser: Chromium Snap; Google Chrome (deb) is also installed

_Written with Claude Code, verified on my machine._