What would cause this behaviour?

[FairyTail2000]

While my PC was idling I received the popup that a new connection was about to be established. But the executable was named "conn fd=5" which is really weird.

Reading the logs shows the following:

[2024-01-14 18:26:08] ERR GetInfo() path can't be read
[2024-01-14 18:26:23] IMP Saved new rule: deny if list is '[{"type": "simple", "operand": "dest.host", "data": "broker.hivemq.com"}, {"type": "simple", "operand": "process.path", "data": "conn fd=5"}]'

Reading the source code in the ReadPath function the only way for it to fail and set a name if this condition is false: p.Path != "" && core.IsAbsPath(p.Path)

And this is true: _, err := os.Lstat(p.pathExe); err != nil
Or os.Readlink(p.pathExe) failed

However the path is only set if the end of the function or in the deferred function to the Command Line of the Process

So I'm wondering, what happened here? Why is a file descriptor opening a network socket? Why can't OpenSnitch show me the file name?
I haven't verified that no malicous code is running on my PC but that's the only time that happened and my PC is behaving like it should.

Any Ideas?

[gustavo-iniguez-goya]

Hi @FairyTail2000 !

It failed to obtain the path, so it used the value of the process name as seen by the kernel (/proc//comm).

A few more questions:

• What opensnitch version are you using?
• What proc monitor method are you using? ebpf? There's a info message in the logs: "Process monitor method ebpf/proc"
• Do you know what software could be opening an outbound connection to broker.hivemq.com ? Is it running in a container (docker/k8s or appimage/flatpak/firejail/etc)?

[FairyTail2000]

Thanks for the response

Opensnitch Version: 1.6.4-1 (Official Repo (Manjaro))
Opensnitch EBPF Module Version (AUR): 1.6.4.1
Monitor Mode: EBPF
The process opening the connection is appimaged (which I found out after this post), before and after this log message appimaged (as an appimage) was recognized without problems

[gustavo-iniguez-goya]

Thank you for the information. A few more questions.

Do you suspend your computer on a regular basis? There's a bug after coming back from suspend state that affects how we intercept new commands.
If you change the log level to DEBUG (Preferences -> Nodes), every command execution should be logged to /var/log/opensnitchd.log ([eBPF exec event] ... ). When this bug is reproduced, not all commands are logged.

Is it possible to know the AppImage in order to test it locally? I've got a dozens of AppImages, and almost all of them launches their processes in a different manner, maybe we're failing on a particular case.

[FairyTail2000]

Thanks for the feedback,

I have disabled suspension on my pc due to work related reasons. The Display was on and the computer was awake and shifting bytes around.
Regarding the reproducibility, I'm not sure how to trigger it as it popped up out of the blue.

Google Drive is where I uploaded the AppImage for you. The SHA256 is 83b5f1c9fb9fdc10871e12b8e832009c1467b27bf5eca3de8a9342096815340f

The AppImage makes a new hivemq connection exactly every 30 seconds, which is a known "feature" (bug)

Actually coming over here I wasn't trying to create a bug report but simply wanted to know how that could have happened since before and after that, it never happened again. It's always possible that this was a charged particle flipping a 0 to a 1 at the perfect moment

[gustavo-iniguez-goya]

thank you @FairyTail2000 . AppImage downloaded, you can remove it from gdrive.

In principle it's a regular appimage. So maybe the process was not in cache when the connection was about to be established, we tried to get the path from /proc but as the AppImages are a bit special we were not able to obtain the path.

It shouldn't be a problem and hopefully it won't appear again.

[FairyTail2000]

If it reappears I will try to isolate the problem and open a proper bug

Until then, thank you for helping to build OpenSnitch