{"record":{"id":"7a8a99313d898cef","repo":"XTLS/Xray-core","slug":"could-not-search-in","errorCode":null,"errorMessage":"could not search in ","messagePattern":"could not search in ","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"common/net/find_process_linux.go","lineNumber":55,"sourceCode":"\t\t}\n\tcase \"udp\":\n\t\tif net.ParseIP(srcIP).To4() != nil {\n\t\t\tprocFile = \"/proc/net/udp\"\n\t\t} else {\n\t\t\tprocFile = \"/proc/net/udp6\"\n\t\t}\n\tdefault:\n\t\tpanic(\"Unsupported network type for process lookup.\")\n\t}\n\n\ttargetHexAddr, err := formatLittleEndianString(net.ParseIP(srcIP), Port(srcPort))\n\tif err != nil {\n\t\treturn 0, \"\", \"\", errors.New(\"failed to format address: \", err)\n\t}\n\n\tinode, err := findInodeInFile(procFile, targetHexAddr)\n\tif err != nil {\n\t\treturn 0, \"\", \"\", errors.New(\"could not search in \", procFile).Base(err)\n\t}\n\tif inode == \"\" {\n\t\treturn 0, \"\", \"\", errors.New(\"connection for \", srcIP, \":\", srcPort, \" not found in \", procFile)\n\t}\n\n\tpidStr, err := findPidByInode(inode)\n\tif err != nil {\n\t\treturn 0, \"\", \"\", errors.New(\"could not find PID for inode \", inode, \": \", err)\n\t}\n\tif pidStr == \"\" {\n\t\treturn 0, \"\", \"\", errors.New(\"no process found for inode \", inode)\n\t}\n\n\tabsPath, err := getAbsPath(pidStr)\n\tif err != nil {\n\t\treturn 0, \"\", \"\", errors.New(\"could not get process name for PID \", pidStr, \":\", err)\n\t}\n","sourceCodeStart":37,"sourceCodeEnd":73,"githubUrl":"https://github.com/XTLS/Xray-core/blob/7d214f8b094f75322fa3990f8aadad1c912f24f5/common/net/find_process_linux.go#L37-L73","documentation":"Linux FindProcess could not read the kernel socket table (/proc/net/tcp, tcp6, udp or udp6) while searching for the connection's inode. The error is chained (Base) to the os.Open / scanner failure, so the underlying reason (usually EACCES or ENOENT) is in err's chain.","triggerScenarios":"/proc is not mounted (rare, broken container), /proc/net/tcp is unreadable due to hidepid or LSM policy, or the file read fails mid-scan. The path in the message tells which table was being read.","commonSituations":"Hardened containers where /proc is masked or mounted with subset=pid; grsecurity kernels restricting /proc/net; chroots without /proc.","solutions":["Inspect the chained error for EACCES vs ENOENT to distinguish policy from missing /proc","Remount /proc properly in the container: docker run --rm with default /proc, avoid --proc-mounted subset=pid for this workload","If the environment intentionally hides /proc, disable process-based routing rules there","Run as a user allowed to read /proc/net/tcp (world-readable by default; a denial indicates an LSM/hidepid policy)"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"for _, f := range []string{\"/proc/net/tcp\", \"/proc/net/udp\", \"/proc/net/tcp6\", \"/proc/net/udp6\"} {\n    if _, err := os.Stat(f); err != nil {\n        // /proc unavailable; process lookup cannot work in this environment\n    }\n}","typeGuard":null,"tryCatchPattern":"if err != nil && strings.Contains(err.Error(), \"could not search in /proc/net\") {\n    // inspect chained error: EACCES => policy, ENOENT => /proc missing; both environment-level\n    newError(\"/proc unreadable; disabling process rules\").Base(err).WriteToLog()\n}","preventionTips":["Do not mount /proc with subset=pid or hidepid when process routing is needed","Health-check /proc/net/tcp availability at startup and disable process rules proactively"],"tags":["linux","procfs","process-lookup","containers","permissions"],"backgroundTag":null,"analyzedSha":"7d214f8b094f75322fa3990f8aadad1c912f24f5","analyzedAt":"2026-08-15T14:26:24.325Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}