Skip to content

start_internal_proxy: launch fails because proxy socket path mismatch (/tmp/ vs /run/) #28

Description

@xulis

Description

start_internal_proxy: true fails to launch in 0.9.29 (and 0.9.27) because of a path mismatch between where the proxy creates its Unix socket and where the pre-launch check expects it.

Environment

  • finSAFE 0.9.29 (personal CLI, installed via install.sh)
  • Linux 6.8.0-124-generic, x86_64
  • Landlock ABI v4, bwrap available
  • Ubuntu 24.04

Steps to reproduce

Run with any policy that sets start_internal_proxy: true and network: !allowlist:

finsafe --policy <policy-with-allowlist.yaml> run -- curl https://example.com/

Expected behavior

The proxy starts on 127.0.0.1:60080, the child gets HTTP_PROXY env vars pointing to it, and curl succeeds on allowlisted domains.

Actual behavior

Pre-launch check fails immediately:

finsafe: launch failed: Bubblewrap mount target(s) missing in rootfs: /run/finsafe-proxy.sock.
With ro-bind rootfs, these paths must be pre-created in the image (for example: /workspace, /home/user).

Root cause (from strace)

The proxy binds its Unix socket to a temp path:

bind(3, {sun_path="/tmp/finsafe-internal-proxy-XXXX/proxy.sock"}) = 0

But the pre-launch check (and the bwrap --ro-bind mount target) expects /run/finsafe-proxy.sock to exist on the host filesystem:

stat("/run/finsafe-proxy.sock") → ENOENT

Two different paths → always fails.

Additional findings

  • When /run/finsafe-proxy.sock is pre-created with touch, the launch succeeds and the proxy does start listening on 127.0.0.1:60080, and HTTP(S)_PROXY env vars are correctly injected into the child.
  • But with a stale touch file, the proxy cannot bind to /run/finsafe-proxy.sock (the existing file blocks it) and the child gets Connection refused.

Workaround

Temporary workaround: pre-create a symbolic link from /run/finsafe-proxy.sock → the tmp socket path, but this is fragile and the tmp path changes each run.

Related

Closes #24 (supersedes with clear root cause).

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions