[Bug Report] v1.7.0-rc sometimes detects wrong user and wrong process

[antonsoroko]

Describe the bug:

v1.7.0-rc.1/2 sometimes detects wrong user (0 instead of 1000) and wrong process (see screenshot).
sometimes it works fine, like old versions (e.g. v1.6.8).

Include the following information:

• OpenSnitch version: v1.7.0-rc.2
• OS: Ubuntu
• OS version: 24.04.2 LTS
• Window Manager: KDE 5.27.12
• Kernel version: Linux 6.8.0-57-generic x86_64

To Reproduce:

Steps to reproduce the behavior:

1. launch Kodi as user several times
2. launch variety from its autostart script
3. see message from opensnitch

Post error logs:

Expected behavior (optional):

it used to be ok: user was 1000 for user's apps, and command line was /usr/bin/python3 /usr/bin/variety for variety

Screenshots:

Additional context:

[gustavo-iniguez-goya]

Hi @antonsoroko !

Did you install kodi from the apt or from their website? I don't think it's directly related to kodi, but let's see if I can reproduced it with it.

[antonsoroko]

@gustavo-iniguez-goya hi. apt. i use backported version 21.2 from "deb multimedia repo", i got it from https://launchpad.net/~ubuntuhandbook1/+archive/ubuntu/kodi

it is compiled against python3.12 (same as "standard" version kodi 20.5 from ubuntu repo).

for variety app - also python 3.12. variety was installed from ubuntu repo.

but i have not had any issue with bot app with opensnitch v1.6.8.

thanks.

I wanted to add a comment before now but I was able to re-produce similar behavior prior to 2a8f13d and limit changes. In my case, it seemed to coincide with a busy system during software compilation and transfer of large files over the network. I was able to capture debug logs which all showed DBG [ebpf conn] not in cache, but in execEvents.

I then began to update utils/scripts/debug-ebpf-maps.sh but I think a full rewrite with jq is a better direction. Although I didn't manually observe a "full" map (some were close), since 2a8f13d and increase of the Max events and Max stats I've not encountered another misidentification of any connections.

[gustavo-iniguez-goya]

I don't think it's related to that commit. I've observed this behaviour previously (actually, it has always been there), but since I'm testing new features I didn't pay much attention .

I'd say that it could be related with the cache of events, or the connections cache.

@lainedfles could you try to reproduce it, with LogLevel to -1 (change it manually in default-config.json).

I've manged to re-produce the problem without additional load or configuration changes and suspect the problem lies somewhere within the procmon process tree details logic. Since I don't understand the code (yet), I may add some additional trace logging in attempt to identify the problem locally. Unless you can pinpoint a culprit first.

This loop seems to reliably trigger a problem gathering p.pathExe for child processes or perhaps later processing of p.Path? It looks like the shell environment PATH is iterated (which includes /home/user/.pyenv/shims:/home/user/perl5/bin:/usr/local/sbin:/usr/local/bin:/usr/bin) and an incorrect value is selected instead of the /proc/pid/exe realpath. The correct pathname should always be /usr/bin/podman.

DRY_RUN='time'; declare -A IMAGES=(['image1']='latest' ['image2']='latest'); for HOST in host1; do echo "-+-+-+-+ Processing $HOST +-+-+-+-"; for IMAGE in "${!IMAGES[@]}"; do echo "-_-_-_ Pushing localhost/${IMAGE}:${IMAGES[$IMAGE]} to ${HOST}::localhost/${IMAGE}:${IMAGES[$IMAGE]} _-_-_-"; $DRY_RUN podman image scp "localhost/${IMAGE}:${IMAGES[$IMAGE]}" "${HOST}::localhost/${IMAGE}:${IMAGES[$IMAGE]}"; done; done

I'd like to avoid sharing the millions of lines of trace logging. Hopefully these sanitized snippets provide enough information. I've focused on "ppid": 1892670, "pid": 1892671, "pid": 1892687, and podman.

The execMap for parent and child PIDs:

[{
        "key": 8128955754012990,
        "value": {
            "type": 1,
            "pid": 1892670,
            "uid": 1000,
            "ppid": 1247116,
            "ret_code": 0,
            "_pad": 0,
            "args_count": 6,
            "args_partial": 0,
            "filename": "/usr/bin/time",
            "args": ["time","podman","image","scp","localhost/image1:latest","host1::localhost/image1:latest","","","","","","","","","","","","","",""
            ],
            "comm": "bash"
        }
    },{
        "key": 8128960048980287,
        "value": {
            "type": 1,
            "pid": 1892671,
            "uid": 1000,
            "ppid": 1892670,
            "ret_code": 0,
            "_pad": 0,
            "args_count": 5,
            "args_partial": 0,
            "filename": "/usr/bin/podman",
            "args": ["podman","image","scp","localhost/image1:latest","host1::localhost/image1:latest","","","","","","","","","","","","","","",""
            ],
            "comm": "time"
        }
    },{
        "key": 8129028768457039,
        "value": {
            "type": 1,
            "pid": 1892687,
            "uid": 1000,
            "ppid": 1892671,
            "ret_code": 0,
            "_pad": 0,
            "args_count": 5,
            "args_partial": 0,
            "filename": "/usr/bin/podman",
            "args": ["/usr/bin/podman","save","--output","/var/tmp/podman1983149310","localhost/image1:latest","","","","","","","","","","","","","","",""
            ],
            "comm": "podman"
        }
    }
]

I'd only considered to investigate /proc/1892671:

lrwxrwxrwx   1 user user  0 Apr 23 20:47 root -> /
lrwxrwxrwx   1 user user  0 Apr 23 20:47 exe -> /usr/bin/podman

/var/log/opensnitchd.log:

[2025-04-23 20:47:52.017019]  INF  ReadRoot() /usr/bin/time -> /
[2025-04-23 20:47:52.017094]  DBG  [eBPF exec event] type: 1, ppid: 1247116, pid: 1892670, /usr/bin/time -> [time podman image scp localhost/image1:latest host1::localhost/image1:latest]
[2025-04-23 20:47:52.017117]  DBG  [cache] EventsStore.Add() 1892670, /usr/bin/time, [], total: 16
[2025-04-23 20:47:52.017126]  TRC  [cache] updateItem() updating events store (total: 16), pid: 1892670, path: /usr/bin/time, []
[2025-04-23 20:47:52.017135]  DBG  [cache] EventsStore.Add() finished 1892670, /usr/bin/time, []
[2025-04-23 20:47:52.017197]  INF  ReadRoot() /usr/bin/bash -> /
[2025-04-23 20:47:52.017228]  INF  ReadRoot() /usr/bin/konsole -> /
[2025-04-23 20:47:52.017258]  INF  ReadRoot() /usr/lib/systemd/systemd -> /
[2025-04-23 20:47:52.017291]  INF  ReadRoot() /usr/lib/systemd/systemd -> /
[2025-04-23 20:47:52.017349]  INF  ReadRoot() /home/user/.pyenv/shims/podman -> /
[2025-04-23 20:47:52.017340]  TRC  [cache] updateItem() updating events store (total: 17), pid: 1892670, path: /usr/bin/time, [key:"/usr/bin/time" value:1892670 key:"/usr/bin/bash" value:1247116 key:"/usr/bin/konsole" value:5082 key:"/usr/lib/systemd/systemd" value:2475 key:"/usr/lib/systemd/systemd" value:1]
[2025-04-23 20:47:52.017354]  INF  ReadRoot() /home/user/perl5/bin/podman -> /
[2025-04-23 20:47:52.017383]  DBG  [eBPF exec event] type: 1, ppid: 1892670, pid: 1892671, /home/user/perl5/bin/podman -> [podman image scp localhost/image1:latest host1::localhost/image1:latest]
[2025-04-23 20:47:52.017388]  DBG  [cache] EventsStore.Add() 1892671, /home/user/perl5/bin/podman, [key:"/usr/bin/time" value:1892670 key:"/usr/bin/bash" value:1247116 key:"/usr/bin/konsole" value:5082 key:"/usr/lib/systemd/systemd" value:2475 key:"/usr/lib/systemd/systemd" value:1], total: 17
[2025-04-23 20:47:52.017400]  TRC  [cache] updateItem() updating events store (total: 17), pid: 1892671, path: /home/user/perl5/bin/podman, [key:"/usr/bin/time" value:1892670 key:"/usr/bin/bash" value:1247116 key:"/usr/bin/konsole" value:5082 key:"/usr/lib/systemd/systemd" value:2475 key:"/usr/lib/systemd/systemd" value:1]
[2025-04-23 20:47:52.017425]  DBG  [cache] EventsStore.Add() finished 1892671, /home/user/perl5/bin/podman, [key:"/usr/bin/time" value:1892670 key:"/usr/bin/bash" value:1247116 key:"/usr/bin/konsole" value:5082 key:"/usr/lib/systemd/systemd" value:2475 key:"/usr/lib/systemd/systemd" value:1]
[2025-04-23 20:47:52.017382]  DBG  [eBPF exec event] type: 1, ppid: 1892670, pid: 1892671, /home/user/.pyenv/shims/podman -> [podman image scp localhost/image1:latest host1::localhost/image1:latest]
[2025-04-23 20:47:52.017450]  DBG  [cache Update old] 1892671 in cache -> /home/user/perl5/bin/podman
[2025-04-23 20:47:52.017468]  INF  ReadRoot() /usr/bin/bash -> /
[2025-04-23 20:47:52.017468]  INF  ReadRoot() /usr/local/sbin/podman -> /
[2025-04-23 20:47:52.017519]  DBG  [eBPF exec event] type: 1, ppid: 1892670, pid: 1892671, /usr/local/sbin/podman -> [podman image scp localhost/image1:latest host1::localhost/image1:latest]
[2025-04-23 20:47:52.017533]  DBG  [cache Update old] 1892671 in cache -> /home/user/perl5/bin/podman
[2025-04-23 20:47:52.017546]  INF  ReadRoot() /usr/bin/podman -> /
[2025-04-23 20:47:52.017459]  TRC  [event inCache, replacement] new: 1892671, /home/user/.pyenv/shims/podman -> inCache: 1892671 -> /home/user/perl5/bin/podman - Trees: [key:"/usr/bin/time" value:1892670 key:"/usr/bin/bash" value:1247116 key:"/usr/bin/konsole" value:5082 key:"/usr/lib/systemd/systemd" value:2475 key:"/usr/lib/systemd/systemd" value:1], [key:"/usr/bin/time" value:1892670 key:"/usr/bin/bash" value:1247116 key:"/usr/bin/konsole" value:5082 key:"/usr/lib/systemd/systemd" value:2475 key:"/usr/lib/systemd/systemd" value:1]
[2025-04-23 20:47:52.017573]  TRC  [cache] updateItem() updating events store (total: 18), pid: 1892671, path: /home/user/.pyenv/shims/podman, [key:"/usr/bin/time" value:1892670 key:"/usr/bin/bash" value:1247116 key:"/usr/bin/konsole" value:5082 key:"/usr/lib/systemd/systemd" value:2475 key:"/usr/lib/systemd/systemd" value:1]
[2025-04-23 20:47:52.017590]  DBG  [cache] ComputeChecksums, already hashed: /home/user/.pyenv/shims/podman -> map[]
[2025-04-23 20:47:52.017596]  TRC  [cache] updateItem() updating events store (total: 18), pid: 1892671, path: /home/user/.pyenv/shims/podman, [key:"/usr/bin/time" value:1892670 key:"/usr/bin/bash" value:1247116 key:"/usr/bin/konsole" value:5082 key:"/usr/lib/systemd/systemd" value:2475 key:"/usr/lib/systemd/systemd" value:1]
[2025-04-23 20:47:52.017604]  DBG  [eBPF event inCache] -> 1892671, /home/user/perl5/bin/podman
[2025-04-23 20:47:52.017483]  INF  ReadRoot() /usr/bin/konsole -> /
[2025-04-23 20:47:52.017559]  DBG  [eBPF exec event] type: 1, ppid: 1892670, pid: 1892671, /usr/bin/podman -> [podman image scp localhost/image1:latest host1::localhost/image1:latest]
[2025-04-23 20:47:52.017539]  TRC  [event inCache, replacement] new: 1892671, /usr/local/sbin/podman -> inCache: 1892671 -> /home/user/perl5/bin/podman - Trees: [key:"/usr/bin/time" value:1892670 key:"/usr/bin/bash" value:1247116 key:"/usr/bin/konsole" value:5082 key:"/usr/lib/systemd/systemd" value:2475 key:"/usr/lib/systemd/systemd" value:1], [key:"/usr/bin/time" value:1892670 key:"/usr/bin/bash" value:1247116 key:"/usr/bin/konsole" value:5082 key:"/usr/lib/systemd/systemd" value:2475 key:"/usr/lib/systemd/systemd" value:1]
[2025-04-23 20:47:52.017643]  DBG  [cache Update old] 1892671 in cache -> /home/user/.pyenv/shims/podman
[2025-04-23 20:47:52.017655]  TRC  [event inCache, replacement] new: 1892671, /usr/bin/podman -> inCache: 1892671 -> /home/user/.pyenv/shims/podman - Trees: [key:"/usr/bin/time" value:1892670 key:"/usr/bin/bash" value:1247116 key:"/usr/bin/konsole" value:5082 key:"/usr/lib/systemd/systemd" value:2475 key:"/usr/lib/systemd/systemd" value:1], [key:"/usr/bin/time" value:1892670 key:"/usr/bin/bash" value:1247116 key:"/usr/bin/konsole" value:5082 key:"/usr/lib/systemd/systemd" value:2475 key:"/usr/lib/systemd/systemd" value:1]
[2025-04-23 20:47:52.017677]  TRC  [cache] updateItem() updating events store (total: 18), pid: 1892671, path: /usr/bin/podman, [key:"/usr/bin/time" value:1892670 key:"/usr/bin/bash" value:1247116 key:"/usr/bin/konsole" value:5082 key:"/usr/lib/systemd/systemd" value:2475 key:"/usr/lib/systemd/systemd" value:1]
[2025-04-23 20:47:52.017689]  DBG  [cache] ComputeChecksums, already hashed: /usr/bin/podman -> map[]
[2025-04-23 20:47:52.017644]  TRC  [cache] updateItem() updating events store (total: 18), pid: 1892671, path: /usr/local/sbin/podman, [key:"/usr/bin/time" value:1892670 key:"/usr/bin/bash" value:1247116 key:"/usr/bin/konsole" value:5082 key:"/usr/lib/systemd/systemd" value:2475 key:"/usr/lib/systemd/systemd" value:1]
[2025-04-23 20:47:52.017703]  DBG  [cache] ComputeChecksums, already hashed: /usr/local/sbin/podman -> map[]
[2025-04-23 20:47:52.017707]  TRC  [cache] updateItem() updating events store (total: 18), pid: 1892671, path: /usr/local/sbin/podman, [key:"/usr/bin/time" value:1892670 key:"/usr/bin/bash" value:1247116 key:"/usr/bin/konsole" value:5082 key:"/usr/lib/systemd/systemd" value:2475 key:"/usr/lib/systemd/systemd" value:1]
[2025-04-23 20:47:52.017713]  DBG  [eBPF event inCache] -> 1892671, /home/user/perl5/bin/podman
[2025-04-23 20:47:52.017402]  INF  ReadRoot() /usr/local/bin/podman -> /
[2025-04-23 20:47:52.017731]  DBG  [eBPF exec event] type: 1, ppid: 1892670, pid: 1892671, /usr/local/bin/podman -> [podman image scp localhost/image1:latest host1::localhost/image1:latest]
[2025-04-23 20:47:52.017735]  DBG  [cache Update old] 1892671 in cache -> /usr/local/sbin/podman
[2025-04-23 20:47:52.017740]  TRC  [event inCache, replacement] new: 1892671, /usr/local/bin/podman -> inCache: 1892671 -> /usr/local/sbin/podman - Trees: [key:"/usr/bin/time" value:1892670 key:"/usr/bin/bash" value:1247116 key:"/usr/bin/konsole" value:5082 key:"/usr/lib/systemd/systemd" value:2475 key:"/usr/lib/systemd/systemd" value:1], [key:"/usr/bin/time" value:1892670 key:"/usr/bin/bash" value:1247116 key:"/usr/bin/konsole" value:5082 key:"/usr/lib/systemd/systemd" value:2475 key:"/usr/lib/systemd/systemd" value:1]
[2025-04-23 20:47:52.017750]  TRC  [cache] updateItem() updating events store (total: 18), pid: 1892671, path: /usr/local/bin/podman, [key:"/usr/bin/time" value:1892670 key:"/usr/bin/bash" value:1247116 key:"/usr/bin/konsole" value:5082 key:"/usr/lib/systemd/systemd" value:2475 key:"/usr/lib/systemd/systemd" value:1]
[2025-04-23 20:47:52.017695]  TRC  [cache] updateItem() updating events store (total: 18), pid: 1892671, path: /usr/bin/podman, [key:"/usr/bin/time" value:1892670 key:"/usr/bin/bash" value:1247116 key:"/usr/bin/konsole" value:5082 key:"/usr/lib/systemd/systemd" value:2475 key:"/usr/lib/systemd/systemd" value:1]
[2025-04-23 20:47:52.017761]  DBG  [eBPF event inCache] -> 1892671, /home/user/.pyenv/shims/podman
[2025-04-23 20:47:52.017651]  INF  ReadRoot() /usr/lib/systemd/systemd -> /
[2025-04-23 20:47:52.017782]  INF  ReadRoot() /usr/lib/systemd/systemd -> /
[2025-04-23 20:47:52.017758]  DBG  [cache] ComputeChecksums, already hashed: /usr/local/bin/podman -> map[]
[2025-04-23 20:47:52.017826]  TRC  [cache] updateItem() updating events store (total: 18), pid: 1892671, path: /usr/local/bin/podman, [key:"/usr/bin/time" value:1892670 key:"/usr/bin/bash" value:1247116 key:"/usr/bin/konsole" value:5082 key:"/usr/lib/systemd/systemd" value:2475 key:"/usr/lib/systemd/systemd" value:1]
[2025-04-23 20:47:52.017839]  DBG  [eBPF event inCache] -> 1892671, /usr/local/sbin/podman
[2025-04-23 20:47:52.017818]  TRC  [cache] updateItem() updating events store (total: 18), pid: 1892671, path: /home/user/perl5/bin/podman, [key:"/usr/bin/time" value:1892670 key:"/usr/bin/bash" value:1247116 key:"/usr/bin/konsole" value:5082 key:"/usr/lib/systemd/systemd" value:2475 key:"/usr/lib/systemd/systemd" value:1]
[2025-04-23 20:47:52.029058]  INF  ReadRoot() /usr/bin/podman -> /
[2025-04-23 20:47:52.029091]  DBG  [eBPF exec event] type: 1, ppid: 1892671, pid: 1892687, /usr/bin/podman -> [/usr/bin/podman save --output /var/tmp/podman1983149310 localhost/image1:latest]
[2025-04-23 20:47:52.029101]  DBG  [cache] EventsStore.Add() 1892687, /usr/bin/podman, [key:"/usr/bin/time" value:1892670 key:"/usr/bin/bash" value:1247116 key:"/usr/bin/konsole" value:5082 key:"/usr/lib/systemd/systemd" value:2475 key:"/usr/lib/systemd/systemd" value:1], total: 18
[2025-04-23 20:47:52.029115]  TRC  [cache] updateItem() updating events store (total: 18), pid: 1892687, path: /usr/bin/podman, [key:"/usr/bin/time" value:1892670 key:"/usr/bin/bash" value:1247116 key:"/usr/bin/konsole" value:5082 key:"/usr/lib/systemd/systemd" value:2475 key:"/usr/lib/systemd/systemd" value:1]
[2025-04-23 20:47:52.029126]  DBG  [cache] EventsStore.Add() finished 1892687, /usr/bin/podman, [key:"/usr/bin/time" value:1892670 key:"/usr/bin/bash" value:1247116 key:"/usr/bin/konsole" value:5082 key:"/usr/lib/systemd/systemd" value:2475 key:"/usr/lib/systemd/systemd" value:1]
[2025-04-23 20:47:52.029187]  INF  ReadRoot() /usr/bin/bash -> /
[2025-04-23 20:47:52.029211]  INF  ReadRoot() /usr/bin/konsole -> /
[2025-04-23 20:47:52.029229]  INF  ReadRoot() /usr/lib/systemd/systemd -> /
[2025-04-23 20:47:52.029244]  INF  ReadRoot() /usr/lib/systemd/systemd -> /
[2025-04-23 20:47:52.029274]  TRC  [cache] updateItem() updating events store (total: 19), pid: 1892687, path: /usr/bin/podman, [key:"/usr/bin/time" value:1892670 key:"/usr/bin/bash" value:1247116 key:"/usr/bin/konsole" value:5082 key:"/usr/lib/systemd/systemd" value:2475 key:"/usr/lib/systemd/systemd" value:1]

...

[2025-04-23 20:48:08.787468]  DBG  [eBPF exit event] pid: 1892687, ppid: 1892671
[2025-04-23 20:48:08.793272]  TRC  Connection.Parse(): {PACKET: 60 bytes
- Layer 1 (20 bytes) = IPv4     {Contents=[..20..] Payload=[..40..] Version=4 IHL=5 TOS=0 Length=60 Id=28384 Flags=DF FragOffset=0 TTL=64 Protocol=TCP Checksum=39558 SrcIP=192.168.1.7 DstIP=192.168.2.9 Options=[] Padding=[]}
- Layer 2 (40 bytes) = TCP      {Contents=[..40..] Payload=[] SrcPort=56488 DstPort=22(ssh) Seq=1540784009 Ack=0 DataOffset=10 FIN=false SYN=true RST=false PSH=false ACK=false URG=false ECE=false CWR=false NS=false Window=64240 Checksum=26079 Urgent=0 Options=[..5..] Padding=[]}
 0 0x0000000000 1000 4 0 2}
[2025-04-23 20:48:08.793357]  DBG  new connection tcp => 56488:192.168.1.7 -> 192.168.2.9 ():22 uid: 1000, mark: 0
[2025-04-23 20:48:08.793386]  DBG  [ebpf conn] not in cache, but in execEvents: tcp56488192.168.1.7192.168.2.922, 1892671 -> /home/user/perl5/bin/podman -> [podman image scp localhost/image1:latest host1::localhost/image1:latest]
[2025-04-23 20:48:08.793401]  DBG  [ebpf conn] adding item to cache: tcp56488192.168.1.7192.168.2.922

...

[2025-04-23 20:48:10.787647]  TRC  [cache delete] deleted 1892687: /usr/bin/podman

...

[2025-04-23 20:48:36.532489]  DBG  Operator compiled: process.path is '/home/user/perl5/bin/podman'
[2025-04-23 20:48:36.532650]  IMP  Added new rule: allow if process.path is '/home/user/perl5/bin/podman'
[2025-04-23 20:48:36.532662]  DBG  ✔ /home/user/perl5/bin/podman -> 56488:192.168.1.7 => 192.168.2.9:22, mark: 0 (allow-until-restart-simple-home-user-perl5-bin-podman)

[gustavo-iniguez-goya]

thanks @lainedfles . In your case what you're seeing is normal. execve() is trying to discover the executable path following the paths defined in the $PATH variable. Not long ago , I decided to not send failed execve() events , to avoid these extra load and messages. In the end, we don't care (much) how the system tries to resolve the path of a binary.

Unfortunately it turns out that bash scripts may exit with error (but scripted commands work ok), so we were losing track of which was the script that opened a connection, which is really useful when investigating problems.

The error of this issue is different. The first screenshot shows that the UID is 0, when in reality it should probably be 1000 or 991 (systemd-resolved) . Sometimes the UID of a connection may be 0 in kernel (depending on where we've intercepted the connection), but reported by netfilter as 1000.

On the other hand, when replacing gobpf by Cilium (feafe87), I added the UID to the key of a cache entry, to be more unique and avoid collisions:

-       ebpfCache.addNewItem(k, key, proc.ID)
+       ebpfCache.addNewItem(k, key, proc.ID, int(value.UID))

This could be one of the culprits.

Regarding the second screenshot, maybe we're failing replacing the PID of the command /bin/sh && ... with the final PID which should be the one of Variety.

@antonsoroko , it'd be useful if you could set LogLevel to DEBUG in Preferences -> Nodes -> Logging, and as soon as you see any of these errors again, make a copy of /var/log/opensnitch.log and post it here.

In the meantime I'll keep trying to reproduce it on Ubuntu 24.04.

[gustavo-iniguez-goya]

ok, reproduced lol. I was not using v1.7.0rc2 🤦 . The issue is not present in v1.7.0rc1, so we'll see what's going on

[gustavo-iniguez-goya]

Here's an example of apt. Initial command apt update as root.

[eBPF exec event] type: 1, ppid: 4294866920, pid: 25817, uid: 0, /usr/bin/apt -> [apt update]

First connection that Netfilter redirect us, uid: 42:

new connection udp => 33022:127.0.0.1 -> 127.0.0.53 (_http._tcp.archive.ubuntu.com):53 uid: 42, mark: 0
[ebpf conn] not in cache, but in execEvents: udp33022127.0.0.1127.0.0.5353, pid: 25828, uid: 42 -> /usr/lib/apt/methods/http -> [/usr/lib/apt/methods/http]
[ebpf conn] adding item to cache: udp33022127.0.0.1127.0.0.5353

so we executed apt as root, but apt dropped privileges to _apt (42). Netfilter redirect us the connection as this UID (42).

Several requests from apt to _http._tcp.archive.ubuntu.com, _https._tcp.esm.ubuntu.comsecurity.ubuntu.com, followed by systemd-resolved to _http._tcp.security.ubuntu.com, etc. All of them with UID 42 or 991 (systemd-resolved).

All of these requests are found in the execs cache, and we're overwriting the proc UID with the UID of the connection:

opensnitch/daemon/procmon/ebpf/find.go

Lines 181 to 185 in aeb2018

	// Use socket's UID. A process may have dropped privileges.
	// This is the UID that we've always used.
	if ev, found := procmon.EventsCache.IsInStoreByPID(int(value.Pid)); found {
	ev.Proc.UID = int(value.UID)

then we receive a new connection, that's in the cache of connections:

new connection udp => 41662:127.0.0.1 -> 127.0.0.53 (security.ubuntu.com):53 uid: 42, mark: 0
[ebpf conn] in cache: udp41662127.0.0.1127.0.0.5353, pid: 26586, uid: 0 -> /usr/lib/apt/methods/http

but here, we're not overwriting the proc UID:

opensnitch/daemon/procmon/ebpf/find.go

Lines 106 to 108 in aeb2018

	if ev, found := procmon.EventsCache.IsInStoreByPID(cacheItem.Pid); found {
	proc = &ev.Proc
	log.Debug("[ebpf conn] in cache: %s, %d -> %s", k, proc.ID, proc.Path)

in my local changes, since ... years maybe I have this:

if proc.UID != cacheItem.UID {
   proc.UID = cacheItem.UID
}

I've had this issue on Debian months or years ago, but on Ubuntu 24 I can reproduce it constantly.

Basically, unifying this behaviour solves this issue on Ubuntu, at least for apt.

[antonsoroko]

@gustavo-iniguez-goya since you were able to reproduce the issue i guess log from my side is not needed anymore.
btw, if needed i can test a "test build". thanks.

[gustavo-iniguez-goya]

mmh, that'll be really helpful.

Backup the existing /usr/bin/opensnitchd binary, and replace it with this one: opensnitchd-1315.txt.gz

Download latest compiled modules from here: https://github.com/evilsocket/opensnitch/actions/runs/14668029602

Unzip the files to a directory, and change or add "ModulesPath": "/home/xxx/ebpf-mods/..." under "Ebpf": {} in /etc/opensnitchd/default-config.json

[antonsoroko]

@gustavo-iniguez-goya
1.

Download latest compiled modules from here: https://github.com/evilsocket/opensnitch/actions/runs/14668029602

opensnitch-ebpf-modules-6.0-1.5.0 or opensnitch-ebpf-modules-6.0-master? both has opensnitch.o file.

2. should i also do

it'd be useful if you could set LogLevel to DEBUG in Preferences -> Nodes -> Logging, and as soon as you see any of these errors again, make a copy of /var/log/opensnitch.log and post it here.

or not?

[gustavo-iniguez-goya]

@antonsoroko only opensnitch-ebpf-modules-6.0-master.

yeah, if you can change LogLevel , it'll help to debug this issue if it happens again.

truncate /var/log/opensnitchd.log before starting the service, to have a log without too much noise.

[antonsoroko]

@gustavo-iniguez-goya

1. about kodi and uid 0: i ran kodi more than 10 times - all runs were without that issue.
2. also i had issue with apt - opensnitch wanted rules for different user from time to time (apt is dropping its user from root to _apt). looks like now this issue is gone too.
3. about variety, now it is ok with bash issue (like on screenshot above, when it runs like /bin/bash -c "sleep 1 && /usr/bin/variety --profile /home/user/.config/variety/"). but my old rules were for /usr/bin/python3 /usr/bin/variety, now opensnitch wants rules for /usr/bin/variety. it is expected?

[gustavo-iniguez-goya]

thank you @antonsoroko !

About issue 3, yes, it's expected. I also noticed on my ubuntu 24 that sometimes it's detected as /usr/bin/python3 /usr/bin/variety.
I'll take a look at that issue soon, but first I'll add the fix for issues 1 and 2, and release the v1.7.0