{"record":{"id":"2e27adc53dfca4d4","repo":"XTLS/Xray-core","slug":"failed-to-list-processes","errorCode":null,"errorMessage":"failed to list processes","messagePattern":"failed to list processes","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"common/net/find_process_darwin.go","lineNumber":83,"sourceCode":"\tif err != nil {\n\t\treturn 0, \"\", \"\", errors.New(\"invalid source IP address: \", srcIP)\n\t}\n\tsrcAddr = srcAddr.Unmap()\n\n\tvar dstAddr netip.Addr\n\thasDstAddr := false\n\tif destIP != \"\" && destPort != 0 {\n\t\tdstAddr, err = netip.ParseAddr(destIP)\n\t\tif err != nil {\n\t\t\treturn 0, \"\", \"\", errors.New(\"invalid destination IP address: \", destIP)\n\t\t}\n\t\tdstAddr = dstAddr.Unmap()\n\t\thasDstAddr = true\n\t}\n\n\tprocesses, err := unix.SysctlKinfoProcSlice(\"kern.proc.all\")\n\tif err != nil {\n\t\treturn 0, \"\", \"\", errors.New(\"failed to list processes\").Base(err)\n\t}\n\n\tvar bestPID int32\n\tbestLevel := darwinSocketNoMatch\n\tambiguousBest := false\n\n\tfor _, process := range processes {\n\t\tpid := process.Proc.P_pid\n\t\tif pid <= 0 {\n\t\t\tcontinue\n\t\t}\n\n\t\tmatchLevel, err := darwinProcessSocketMatchLevel(pid, network, srcAddr, srcPort, dstAddr, destPort, hasDstAddr)\n\t\tif err != nil || matchLevel == darwinSocketNoMatch {\n\t\t\tcontinue\n\t\t}\n\t\tif matchLevel == darwinSocketExactMatch {\n\t\t\tbestPID = pid","sourceCodeStart":65,"sourceCodeEnd":101,"githubUrl":"https://github.com/XTLS/Xray-core/blob/7d214f8b094f75322fa3990f8aadad1c912f24f5/common/net/find_process_darwin.go#L65-L101","documentation":"Thrown by the macOS implementation of FindProcess when the sysctl 'kern.proc.all' fails to return the process table (unix.SysctlKinfoProcSlice). The library needs the full kinfo_proc list to compare every process's file-descriptor socket addresses against the queried connection. Without the process table, no PID resolution is possible.","triggerScenarios":"Calling common/net.FindProcess on macOS when sysctl kern.proc.all returns an error: sandboxed/masqueraded processes (macOS sandbox denies KERN_PROCALL), a hardened-runtime app without the entitlement to enumerate other processes, or kernel memory pressure making the sysctl fail.","commonSituations":"Running Xray core inside a macOS sandbox (App Store style distribution, iOS-on-mac processes), running under a restricted daemon context, or an extremely loaded system where the sysctl buffer allocation fails.","solutions":["Run the binary outside sandbox-exec / without sandbox profiles, or grant the process-enum entitlement if the app is hardened-runtime signed","Verify manually: sysctl kern.proc.all in a terminal to confirm the sysctl works for your user context","Treat process lookup as best-effort: log and continue without process info in routing rules","If the caller passes a destination address it can improve matching, but nothing fixes a denied sysctl except removing the sandbox"],"exampleFix":"// before\npid, name, path, err := net.FindProcess(network, srcIP, srcPort, dstIP, dstPort)\nif err != nil {\n    return err // lookup failure aborts routing decision\n}\n\n// after\npid, name, path, err := net.FindProcess(network, srcIP, srcPort, dstIP, dstPort)\nif err != nil {\n    newError(\"process lookup unavailable, skipping process rules\").Base(err).WriteToLog()\n    pid, name, path = 0, \"\", \"\"\n}","handlingStrategy":"fallback","validationCode":"// Pre-flight on macOS: verify the sysctl the implementation depends on\nprocs, err := unix.SysctlKinfoProcSlice(\"kern.proc.all\")\nif err != nil || len(procs) == 0 {\n    // process lookup will fail; skip process-based rules\n}","typeGuard":null,"tryCatchPattern":"pid, name, path, err := net.FindProcess(netw, srcIP, srcPort, dstIP, dstPort)\nif err != nil {\n    newError(\"process lookup unavailable\").Base(err).AtWarning().WriteToLog()\n    // route without process info\n}","preventionTips":["Run Xray outside sandbox profiles that deny kern.proc sysctls","Treat process lookup as optional enrichment, never as a hard dependency in routing","Log the wrapped sysctl error once and cache the failure instead of retrying every connection"],"tags":["darwin","process-lookup","sysctl","permissions"],"backgroundTag":null,"analyzedSha":"7d214f8b094f75322fa3990f8aadad1c912f24f5","analyzedAt":"2026-08-15T14:26:24.325Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}