{"record":{"id":"2339855010254f17","repo":"shadowsocks/shadowsocks-rust","slug":"open-dev-pf-permission-denied-consider-restart-w","errorCode":null,"errorMessage":"open /dev/pf permission denied, consider restart with root user","messagePattern":"open /dev/pf permission denied, consider restart with root user","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"crates/shadowsocks-service/src/local/redir/sys/unix/bsd_pf.rs","lineNumber":373,"sourceCode":"        Err(io::Error::other(format!(\n            \"natlook UDP binding {}, {} not found\",\n            bind_addr, peer_addr\n        )))\n    }\n}\n\nimpl Drop for PacketFilter {\n    fn drop(&mut self) {\n        unsafe {\n            libc::close(self.fd);\n        }\n    }\n}\n\npub static PF: LazyLock<PacketFilter> = LazyLock::new(|| match PacketFilter::open() {\n    Ok(pf) => pf,\n    Err(err) if err.kind() == ErrorKind::PermissionDenied => {\n        panic!(\"open /dev/pf permission denied, consider restart with root user\");\n    }\n    Err(err) => {\n        panic!(\"open /dev/pf {err}\");\n    }\n});\n","sourceCodeStart":355,"sourceCodeEnd":379,"githubUrl":"https://github.com/shadowsocks/shadowsocks-rust/blob/8eb0f0a65b1d976ab6bed5787327ef86529b0435/crates/shadowsocks-service/src/local/redir/sys/unix/bsd_pf.rs#L355-L379","documentation":"On BSD systems the redirector's PacketFilter is opened lazily from /dev/pf; the PF static panics with this message when opening it fails with PermissionDenied. /dev/pf is root-only (or requires pf membership), so the redir service on BSD cannot work as an unprivileged user. This is a fail-fast guard rather than a recoverable error.","triggerScenarios":"Lazily initializing `static PF: LazyLock<PacketFilter>` in bsd_pf.rs when a redir server on FreeBSD/OpenBSD/NetBSD calls into the PF NAT lookup and `PacketFilter::open()` returns an error whose kind is ErrorKind::PermissionDenied.","commonSituations":"Running shadowsocks-redir as a non-root user on BSD; starting via systemd without sufficient capabilities; /dev/pf restricted to group _pf or root; pf device not mounted in a jail/container.","solutions":["Restart the redir service as root (e.g. sudo or root-owned systemd unit)","Grant the binary the needed capability/membership (add user to pf group or set uid bits)","Run in a pf-enabled environment (host or jail with /dev/pf allowed)","Verify /dev/pf exists (kldload pf / enable pf ruleset) if the device is absent"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"# ensure /dev/pf is openable before launching the redir service:\ntest -w /dev/pf || echo 'need root or pf group membership'","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Run BSD redir services as root or with explicit pf access","Pre-declare systemd capability/user requirements in the unit file","Check pf module is loaded before service start","Document the root requirement in deployment scripts"],"tags":["panic","bsd","pf-firewall","permissions"],"backgroundTag":"permission-denied","analyzedSha":"8eb0f0a65b1d976ab6bed5787327ef86529b0435","analyzedAt":"2026-09-09T12:20:43.168Z","contentChangedAt":"2026-09-09T12:20:43.168Z","schemaVersion":2},"datasetVersion":"2026-09-14T11:17:12.474Z"}