Description
start_internal_proxy: true fails to launch in 0.9.29 (and 0.9.27) because of a path mismatch between where the proxy creates its Unix socket and where the pre-launch check expects it.
Environment
- finSAFE 0.9.29 (personal CLI, installed via install.sh)
- Linux 6.8.0-124-generic, x86_64
- Landlock ABI v4, bwrap available
- Ubuntu 24.04
Steps to reproduce
Run with any policy that sets start_internal_proxy: true and network: !allowlist:
finsafe --policy <policy-with-allowlist.yaml> run -- curl https://example.com/
Expected behavior
The proxy starts on 127.0.0.1:60080, the child gets HTTP_PROXY env vars pointing to it, and curl succeeds on allowlisted domains.
Actual behavior
Pre-launch check fails immediately:
finsafe: launch failed: Bubblewrap mount target(s) missing in rootfs: /run/finsafe-proxy.sock.
With ro-bind rootfs, these paths must be pre-created in the image (for example: /workspace, /home/user).
Root cause (from strace)
The proxy binds its Unix socket to a temp path:
bind(3, {sun_path="/tmp/finsafe-internal-proxy-XXXX/proxy.sock"}) = 0
But the pre-launch check (and the bwrap --ro-bind mount target) expects /run/finsafe-proxy.sock to exist on the host filesystem:
stat("/run/finsafe-proxy.sock") → ENOENT
Two different paths → always fails.
Additional findings
- When
/run/finsafe-proxy.sock is pre-created with touch, the launch succeeds and the proxy does start listening on 127.0.0.1:60080, and HTTP(S)_PROXY env vars are correctly injected into the child.
- But with a stale
touch file, the proxy cannot bind to /run/finsafe-proxy.sock (the existing file blocks it) and the child gets Connection refused.
Workaround
Temporary workaround: pre-create a symbolic link from /run/finsafe-proxy.sock → the tmp socket path, but this is fragile and the tmp path changes each run.
Related
Closes #24 (supersedes with clear root cause).
Description
start_internal_proxy: truefails to launch in 0.9.29 (and 0.9.27) because of a path mismatch between where the proxy creates its Unix socket and where the pre-launch check expects it.Environment
Steps to reproduce
Run with any policy that sets
start_internal_proxy: trueandnetwork: !allowlist:Expected behavior
The proxy starts on
127.0.0.1:60080, the child getsHTTP_PROXYenv vars pointing to it, and curl succeeds on allowlisted domains.Actual behavior
Pre-launch check fails immediately:
Root cause (from strace)
The proxy binds its Unix socket to a temp path:
But the pre-launch check (and the bwrap
--ro-bindmount target) expects/run/finsafe-proxy.sockto exist on the host filesystem:Two different paths → always fails.
Additional findings
/run/finsafe-proxy.sockis pre-created withtouch, the launch succeeds and the proxy does start listening on127.0.0.1:60080, andHTTP(S)_PROXYenv vars are correctly injected into the child.touchfile, the proxy cannot bind to/run/finsafe-proxy.sock(the existing file blocks it) and the child getsConnection refused.Workaround
Temporary workaround: pre-create a symbolic link from
/run/finsafe-proxy.sock→ the tmp socket path, but this is fragile and the tmp path changes each run.Related
Closes #24 (supersedes with clear root cause).