Opensnitch no longer starts on my machine

[SeaDude]

Describe the bug
Opensnitch doesn't start anymore.

Include the following information:

• 1.6.5
• OS: Ubuntu 22.04.5 LTS
• Version Jammy 22.04
• Window Manager: GNOME
• Kernel version: Linux system9 6.9.3-76060903-generic #202405300957~1721174657~22.04~abb7c06~dev-Ubuntu SMP PREEMPT_DY x86_64 x86_64 x86_64 GNU/Linux

To Reproduce
Opensnitch doesn't start by default anymore.

If the daemon doesn't start or doesn't intercept connections:

• Run opensnitchd -check-requirements to see if your kernel is compatible.
  • Passes all checks

2024-10-20 17:54:37]  WAR  (1) EBPF-DNS: Failed to decode ebpf nameLookupEvent: EOF
[2024-10-20 17:54:37]  WAR  (3) EBPF-DNS: Failed to decode ebpf nameLookupEvent: EOF
[2024-10-21 03:04:08]  IMP  Start writing logs to /var/log/opensnitchd.log

[2024-10-21 03:47:59]  IMP  Got signal: terminated
[2024-10-21 03:47:59]  WAR  (3) EBPF-DNS: Failed to decode ebpf nameLookupEvent: EOF
[2024-10-21 03:47:59]  WAR  (0) EBPF-DNS: Failed to decode ebpf nameLookupEvent: EOF
[2024-10-21 03:47:59]  WAR  (2) EBPF-DNS: Failed to decode ebpf nameLookupEvent: EOF
[2024-10-21 03:47:59]  WAR  (4) EBPF-DNS: Failed to decode ebpf nameLookupEvent: EOF
[2024-10-21 03:47:59]  WAR  (1) EBPF-DNS: Failed to decode ebpf nameLookupEvent: EOF
[2024-10-21 19:34:12]  IMP  Start writing logs to /var/log/opensnitchd.log

[2024-10-21 20:11:34]  IMP  Got signal: terminated
[2024-10-21 20:11:34]  WAR  (4) EBPF-DNS: Failed to decode ebpf nameLookupEvent: EOF
[2024-10-21 20:11:34]  WAR  (3) EBPF-DNS: Failed to decode ebpf nameLookupEvent: EOF
[2024-10-21 20:11:34]  WAR  (0) EBPF-DNS: Failed to decode ebpf nameLookupEvent: EOF
[2024-10-21 20:11:34]  WAR  (1) EBPF-DNS: Failed to decode ebpf nameLookupEvent: EOF
[2024-10-21 20:11:34]  WAR  (2) EBPF-DNS: Failed to decode ebpf nameLookupEvent: EOF
[2024-10-23 13:41:52]  IMP  Start writing logs to /var/log/opensnitchd.log

[CPioGH2002]

Can you check the logs and status of the service?

Service: systemctl status opensnitch.service

Logs:
journalctl -b | grep -i opensnitch
If that one has too much output, add "less" to it like so: journalctl -b | grep -i opensnitch | less (you can then view it line by line or page by page)

Maybe something of note comes up. If you need more context on the second command, use journalctl -b | grep -i -C 2 opensnitch | less which will show two lines before and after the search phrase.

[gustavo-iniguez-goya]

hey @SeaDude , could you provide the info suggested by @CPioGH2002 ?

More tests that can be useful to troubleshoot this issue:

• Change LogLevel to 0 in /etc/opensnitchd/default-config.json and restart the service (service opensnitch restart).
• Launch the daemon manually and see if it runs or exits with any error (verify that it's not already running)

I tested it on an up-to-date ubuntu 22.04 machine and works fine.

[SeaDude]

Can you check the logs and status of the service?

Service: systemctl status opensnitch.service

Logs: journalctl -b | grep -i opensnitch If that one has too much output, add "less" to it like so: journalctl -b | grep -i opensnitch | less (you can then view it line by line or page by page)

Maybe something of note comes up. If you need more context on the second command, use journalctl -b | grep -i -C 2 opensnitch | less which will show two lines before and after the search phrase.

Apologies for the long wait...

Service logs:

$ systemctl status opensnitch.service
● opensnitch.service - Application firewall OpenSnitch
     Loaded: loaded (/lib/systemd/system/opensnitch.service; enabled; vendor pr>
     Active: active (running) since Sat 2024-11-02 11:01:22 PDT; 4 days ago
       Docs: https://github.com/gustavo-iniguez-goya/opensnitch/wiki
   Main PID: 1758 (opensnitchd)
      Tasks: 34 (limit: 76815)
     Memory: 59.0M
        CPU: 4min 37.605s
     CGroup: /system.slice/opensnitch.service
             └─1758 /usr/bin/opensnitchd -rules-path /etc/opensnitchd/rules

Nov 02 11:01:22 mySystem systemd[1]: Starting Application firewall OpenSnitch...
Nov 02 11:01:22 mySystem systemd[1]: Started Application firewall OpenSnitch.
Nov 02 11:01:22 mySystem opensnitchd[1758]: [2024-11-02 18:01:22]  IMP  Starting>
Nov 02 11:01:22 mySystem opensnitchd[1758]: [2024-11-02 18:01:22]  INF  Loading >
Nov 02 11:01:22 mySystem opensnitchd[1758]: [2024-11-02 18:01:22]  INF  Loading >
Nov 02 11:01:23 mySystem opensnitchd[1758]: found /lib/x86_64-linux-gnu/libc.so.6

Logs:

$ journalctl -b | grep -i opensnitch
Nov 02 11:01:22 mySystem systemd[1]: Starting Application firewall OpenSnitch...
Nov 02 11:01:22 mySystem systemd[1]: Started Application firewall OpenSnitch.
Nov 02 11:01:22 mySystem opensnitchd[1758]: [2024-11-02 18:01:22]  IMP  Starting opensnitch-daemon v1.6.5
Nov 02 11:01:22 mySystem opensnitchd[1758]: [2024-11-02 18:01:22]  INF  Loading configuration file /etc/opensnitchd/default-config.json ...
Nov 02 11:01:22 mySystem opensnitchd[1758]: [2024-11-02 18:01:22]  INF  Loading rules from /etc/opensnitchd/rules ...
Nov 02 11:01:23 mySystem opensnitchd[1758]: found /lib/x86_64-linux-gnu/libc.so.6
Nov 02 11:05:07 mySystem opensnitch_ui.desktop[3812]: Traceback (most recent call last):
Nov 02 11:05:07 mySystem opensnitch_ui.desktop[3812]:   File "/usr/bin/opensnitch-ui", line 41, in <module>
Nov 02 11:05:07 mySystem opensnitch_ui.desktop[3812]:     from opensnitch.service import UIService
Nov 02 11:05:07 mySystem opensnitch_ui.desktop[3812]:   File "/usr/lib/python3/dist-packages/opensnitch/service.py", line 15, in <module>
Nov 02 11:05:07 mySystem opensnitch_ui.desktop[3812]:     from opensnitch import ui_pb2
Nov 02 11:05:07 mySystem opensnitch_ui.desktop[3812]:   File "/usr/lib/python3/dist-packages/opensnitch/ui_pb2.py", line 32, in <module>
Nov 02 11:05:07 mySystem opensnitch_ui.desktop[3812]:     _descriptor.EnumValueDescriptor(
Nov 02 11:05:07 mySystem opensnitch_ui.desktop[3812]:   File "/home/mySystem/.local/lib/python3.10/site-packages/google/protobuf/descriptor.py", line 920, in __new__
Nov 02 11:05:07 mySystem opensnitch_ui.desktop[3812]:     _message.Message._CheckCalledFromGeneratedFile()
Nov 02 11:05:07 mySystem opensnitch_ui.desktop[3812]: TypeError: Descriptors cannot be created directly.
Nov 02 11:05:07 mySystem opensnitch_ui.desktop[3812]: If this call came from a _pb2.py file, your generated code is out of date and must be regenerated with protoc >= 3.19.0.
Nov 02 11:05:07 mySystem opensnitch_ui.desktop[3812]: If you cannot immediately regenerate your protos, some other possible workarounds are:
Nov 02 11:05:07 mySystem opensnitch_ui.desktop[3812]:  1. Downgrade the protobuf package to 3.20.x or lower.
Nov 02 11:05:07 mySystem opensnitch_ui.desktop[3812]:  2. Set PROTOCOL_BUFFERS_PYTHON_IMPLEMENTATION=python (but this will use pure-Python parsing and will be much slower).
Nov 02 11:05:07 mySystem opensnitch_ui.desktop[3812]: More information: https://developers.google.com/protocol-buffers/docs/news/2022-05-06#python-updates

[SeaDude]

FYI, still passes all checks but won't start.

$ opensnitchd -check-requirements

	Checking system requirements for kernel version 6.9.3-76060903-generic
------------------------------------------------------------------------------

	Checking => CONFIG_KPROBES=y
	Checking => CONFIG_KPROBES_ON_FTRACE=y
	Checking => CONFIG_KPROBES_ON_FTRACE=y
	Checking => CONFIG_HAVE_KPROBES=y
	Checking => CONFIG_HAVE_KPROBES_ON_FTRACE=y
	Checking => CONFIG_KPROBE_EVENTS=y

	* kprobes	 ✔

	Checking => CONFIG_UPROBES=y
	Checking => CONFIG_UPROBE_EVENTS=y

	* uprobes	 ✔

	Checking => CONFIG_FTRACE=y

	* ftrace	 ✔

	Checking => CONFIG_HAVE_SYSCALL_TRACEPOINTS=y
	Checking => CONFIG_FTRACE_SYSCALLS=y

	* syscalls	 ✔

	Checking => CONFIG_NETFILTER_NETLINK_QUEUE=[my]
	Checking => CONFIG_NFT_QUEUE=[my]
	Checking => CONFIG_NETFILTER_XT_TARGET_NFQUEUE=[my]

	* nfqueue	 ✔

	Checking => CONFIG_NETFILTER_NETLINK=[my]
	Checking => CONFIG_NETFILTER_NETLINK_QUEUE=[my]
	Checking => CONFIG_NETFILTER_NETLINK_ACCT=[my]

	* netlink	 ✔

	Checking => CONFIG_INET_DIAG=[my]
	Checking => CONFIG_INET_TCP_DIAG=[my]
	Checking => CONFIG_INET_UDP_DIAG=[my]
	Checking => CONFIG_INET_DIAG_DESTROY=[my]

	* net diagnostics	 ✔

[SeaDude]

After setting LogLevel to 0 and restarting the service:

mySystem@mySystem:/etc/opensnitchd$ cat default-config.json 
{
    "Server":
    {
        "Address":"unix:///tmp/osui.sock",
        "LogFile":"/var/log/opensnitchd.log"
    },
    "DefaultAction": "allow",
    "DefaultDuration": "once",
    "InterceptUnknown": false,
    "ProcMonitorMethod": "ebpf",
    "LogLevel": 0,
    "LogUTC": true,
    "LogMicro": false,
    "Firewall": "nftables",
    "Stats": {
        "MaxEvents": 150,
        "MaxStats": 25,
        "Workers": 6
    }
}
mySystem@mySystem:/etc/opensnitchd$ service opensnitch restart
mySystem@mySystem:/etc/opensnitchd$ journalctl -b | grep -i opensnitch
Nov 02 11:01:22 mySystem systemd[1]: Starting Application firewall OpenSnitch...
Nov 02 11:01:22 mySystem systemd[1]: Started Application firewall OpenSnitch.
Nov 02 11:01:22 mySystem opensnitchd[1758]: [2024-11-02 18:01:22]  IMP  Starting opensnitch-daemon v1.6.5
Nov 02 11:01:22 mySystem opensnitchd[1758]: [2024-11-02 18:01:22]  INF  Loading configuration file /etc/opensnitchd/default-config.json ...
Nov 02 11:01:22 mySystem opensnitchd[1758]: [2024-11-02 18:01:22]  INF  Loading rules from /etc/opensnitchd/rules ...
Nov 02 11:01:23 mySystem opensnitchd[1758]: found /lib/x86_64-linux-gnu/libc.so.6
Nov 02 11:05:07 mySystem opensnitch_ui.desktop[3812]: Traceback (most recent call last):
Nov 02 11:05:07 mySystem opensnitch_ui.desktop[3812]:   File "/usr/bin/opensnitch-ui", line 41, in <module>
Nov 02 11:05:07 mySystem opensnitch_ui.desktop[3812]:     from opensnitch.service import UIService
Nov 02 11:05:07 mySystem opensnitch_ui.desktop[3812]:   File "/usr/lib/python3/dist-packages/opensnitch/service.py", line 15, in <module>
Nov 02 11:05:07 mySystem opensnitch_ui.desktop[3812]:     from opensnitch import ui_pb2
Nov 02 11:05:07 mySystem opensnitch_ui.desktop[3812]:   File "/usr/lib/python3/dist-packages/opensnitch/ui_pb2.py", line 32, in <module>
Nov 02 11:05:07 mySystem opensnitch_ui.desktop[3812]:     _descriptor.EnumValueDescriptor(
Nov 02 11:05:07 mySystem opensnitch_ui.desktop[3812]:   File "/home/mySystem/.local/lib/python3.10/site-packages/google/protobuf/descriptor.py", line 920, in __new__
Nov 02 11:05:07 mySystem opensnitch_ui.desktop[3812]:     _message.Message._CheckCalledFromGeneratedFile()
Nov 02 11:05:07 mySystem opensnitch_ui.desktop[3812]: TypeError: Descriptors cannot be created directly.
Nov 02 11:05:07 mySystem opensnitch_ui.desktop[3812]: If this call came from a _pb2.py file, your generated code is out of date and must be regenerated with protoc >= 3.19.0.
Nov 02 11:05:07 mySystem opensnitch_ui.desktop[3812]: If you cannot immediately regenerate your protos, some other possible workarounds are:
Nov 02 11:05:07 mySystem opensnitch_ui.desktop[3812]:  1. Downgrade the protobuf package to 3.20.x or lower.
Nov 02 11:05:07 mySystem opensnitch_ui.desktop[3812]:  2. Set PROTOCOL_BUFFERS_PYTHON_IMPLEMENTATION=python (but this will use pure-Python parsing and will be much slower).
Nov 02 11:05:07 mySystem opensnitch_ui.desktop[3812]: More information: https://developers.google.com/protocol-buffers/docs/news/2022-05-06#python-updates
Nov 06 21:19:59 mySystem polkitd(authority=local)[1579]: Operator of unix-session:3 successfully authenticated as unix-user:mySystem to gain TEMPORARY authorization for action org.freedesktop.systemd1.manage-units for system-bus-name::1.332 [systemctl restart opensnitch.service] (owned by unix-user:mySystem)
Nov 06 21:19:59 mySystem systemd[1]: Stopping Application firewall OpenSnitch...
Nov 06 21:20:05 mySystem systemd[1]: opensnitch.service: Deactivated successfully.
Nov 06 21:20:05 mySystem systemd[1]: Stopped Application firewall OpenSnitch.
Nov 06 21:20:05 mySystem systemd[1]: opensnitch.service: Consumed 4min 42.966s CPU time.
Nov 06 21:20:05 mySystem systemd[1]: Starting Application firewall OpenSnitch...
Nov 06 21:20:05 mySystem systemd[1]: Started Application firewall OpenSnitch.
Nov 06 21:20:05 mySystem opensnitchd[23490]: [2024-11-07 05:20:05]  IMP  Starting opensnitch-daemon v1.6.5
Nov 06 21:20:05 mySystem opensnitchd[23490]: [2024-11-07 05:20:05]  INF  Loading configuration file /etc/opensnitchd/default-config.json ...
Nov 06 21:20:05 mySystem opensnitchd[23490]: [2024-11-07 05:20:05]  INF  Loading rules from /etc/opensnitchd/rules ...
Nov 06 21:20:05 mySystem opensnitchd[23490]: Timed out while sending packet to queue channel 846697845
Nov 06 21:20:05 mySystem opensnitchd[23490]: found /lib/x86_64-linux-gnu/libc.so.6
Nov 06 21:27:47 mySystem audit[4441]: AVC apparmor="DENIED" operation="open" class="file" profile="snap.firefox.firefox" name="/etc/opensnitchd/default-config.json" pid=4441 comm=53747265616D547E6E732023373638 requested_mask="r" denied_mask="r" fsuid=1000 ouid=0
Nov 06 21:27:47 mySystem audit[4441]: AVC apparmor="DENIED" operation="open" class="file" profile="snap.firefox.firefox" name="/etc/opensnitchd/default-config.json" pid=4441 comm="FSBroker23885" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0
Nov 06 21:28:30 mySystem sudo[23948]:  mySystem : TTY=pts/0 ; PWD=/etc/opensnitchd ; USER=root ; COMMAND=/usr/bin/nano default-config.json
Nov 06 21:29:20 mySystem polkitd(authority=local)[1579]: Operator of unix-session:3 successfully authenticated as unix-user:mySystem to gain TEMPORARY authorization for action org.freedesktop.systemd1.manage-units for system-bus-name::1.341 [systemctl restart opensnitch.service] (owned by unix-user:mySystem)
Nov 06 21:29:20 mySystem systemd[1]: Stopping Application firewall OpenSnitch...
Nov 06 21:29:20 mySystem systemd[1]: opensnitch.service: Deactivated successfully.
Nov 06 21:29:20 mySystem systemd[1]: Stopped Application firewall OpenSnitch.
Nov 06 21:29:20 mySystem systemd[1]: opensnitch.service: Consumed 9.846s CPU time.
Nov 06 21:29:20 mySystem systemd[1]: Starting Application firewall OpenSnitch...
Nov 06 21:29:20 mySystem systemd[1]: Started Application firewall OpenSnitch.
Nov 06 21:29:20 mySystem opensnitchd[23985]: [2024-11-07 05:29:20]  IMP  Starting opensnitch-daemon v1.6.5
Nov 06 21:29:20 mySystem opensnitchd[23985]: [2024-11-07 05:29:20]  INF  Loading configuration file /etc/opensnitchd/default-config.json ...
Nov 06 21:29:20 mySystem opensnitchd[23985]: [2024-11-07 05:29:20]  INF  Loading rules from /etc/opensnitchd/rules ...
Nov 06 21:29:20 mySystem opensnitchd[23985]: Timed out while sending packet to queue channel 2061419422
Nov 06 21:29:20 mySystem opensnitchd[23985]: Timed out while sending packet to queue channel 2061419422
Nov 06 21:29:20 mySystem opensnitchd[23985]: Timed out while sending packet to queue channel 2061419422
Nov 06 21:29:20 mySystem opensnitchd[23985]: Timed out while sending packet to queue channel 2061419422
Nov 06 21:29:21 mySystem opensnitchd[23985]: found /lib/x86_64-linux-gnu/libc.so.6

[CPioGH2002]

Not saying that I'm an expert but, to me, it looks like the service does ok but the (Python-based) UI app does not in your case. Besides, the version should be at 1.6.6 since a while, so perhaps consider updating, just in case: https://github.com/evilsocket/opensnitch/releases

[gustavo-iniguez-goya]

ah I see @SeaDude , the problem is this:

Nov 02 11:05:07 mySystem opensnitch_ui.desktop[3812]: If this call came from a _pb2.py file, your generated code is out of date and must be regenerated with protoc >= 3.19.0.
Nov 02 11:05:07 mySystem opensnitch_ui.desktop[3812]:  1. Downgrade the protobuf package to 3.20.x or lower.
Nov 02 11:05:07 mySystem opensnitch_ui.desktop[3812]:  2. Set PROTOCOL_BUFFERS_PYTHON_IMPLEMENTATION=python (but this will use pure-Python parsing and will be much slower).

This is a known issue https://github.com/evilsocket/opensnitch/wiki/GUI-known-problems

The temporal solution is to downgrade python3-protobuf: $ pip install protobuf==3.20.6

One solution could be distributing two protobuffers compiled with different versions, to support old and new python3-grpcio versions.

[SeaDude]

@gustavo-iniguez-goya ...there is no protobuf v.3.20.6...

• https://pypi.org/project/protobuf/#history

[SeaDude]

Man, I really liked the piece of mind that opensnitch provided me. I felt protected. When the UI stopped suddenly yet running top showed opensnitch was still running headless...that felt weird. I opened this ticket, but the fix proposed didn't work so I completely uninstalled and purged. Upon reinstall, I got some sort of permission denied error (even though I ran as sudo) and there are so many caveats on the install page..I don't want to troubleshoot any further.

I'll sponsor you for what I can, for all the hard work you've done and check back in the future.

Thank you

[gustavo-iniguez-goya]

I'm really sorry to hear this @SeaDude . I'm working on a solution for this case. We'll see if it works.

[gustavo-iniguez-goya]

Quick update on what's going on here. tl;dr:

~ $ pip3 install grpcio==1.41.0
~ $ pip3 install protobuf==3.19.0

There're two problems in Ubuntu 22.x:

1. Faulty python3-grpcio version 1.30.2-3-build6 (issue 647, https://bugs.launchpad.net/ubuntu/+source/grpc/+bug/1971114):

   • Ubuntu 22.04 (LinuxMint 21.x, PopOS 22.x, ...) ships python3-grpcio version 1.30.2-3-build6, which has a bug that causes CPU 100% usage (any app which uses that package, not only OpenSnitch).
   • The temporal solution to this problem is to install grpcio > 1.40.0 system wide, or as your regular use (~ $ pip3 install grpcio==1.41.0

2. protobuf version >= 4.x.x is incompatible with grpcio < 1.40.0:

   • Ubuntu 22.04 also ships by default python3-protobuf version 3.12.4 which works fine.
   • Some systems though has protobuf > 4.x.x installed, which in combination with grpcio < 1.40.0 causes in OpenSnitch the error TypeError: Descriptors cannot be created directly -> Downgrade the protobuf package to 3.20.x or lower (as seen in the logs posted above).
   • The temporal solution to this problem is to install as your regular user protobuf < 4.x.x (~ $ pip3 install protobuf==3.19.0)

The solution I'm testing that solves the second problem is to distribute 2 protobuffers instead of 1 (it should help for future incompatibilities):

• one for protobuf >= 3.8.0 and < 4.x.x
• another one for protobuf > 4.x.x

The first problem with python3-grpcio 1.30.2-3-build6 is not solvable on our end as far as I can tell (without distributing the grpcio package). It seems that there's people willing to fix this error by pushing a fix for ubuntu 22 (on the launchpad link).

Regarding the error you have reported in this issue, it seems that somehow your system now has protobuf == 4.x.x installed, and that could be causing the GUI to fail.

You can check it with: ~ $ pip3 list installed | grep protobuf and ~ $ pip3 list installed | grep grpcio (launching opensnitch-ui will also show the versions).

[netstat-peanut]

Hi, sorry to comment on a closed issue. I also have this aids. I try all the pip install 'no dont do that it break everything' ok apt install python3-blah pip3 cartwheel go python3 hail mary venv python3.11 == version song and dance but now I only want to smash the monitor. Is there a fix merge? I also try to build clone but same problems
Sometime I envy health of care free windows user :(

[gustavo-iniguez-goya]

hey @netstat-peanut ,

It's really unfortunate that you've run into this problem. Could you tell us more info about your system?

• Distro version
• grpcio and protobuf versions: pip3 list installed | grpcio , pip3 list installed | protobuf
• Launch opensnitch-ui from a terminal and post the first 2 lines with the versions.

Remember that sometimes is ok to smash the monitor ;)