{"record":{"id":"9929a801ad30cc0a","repo":"ruvnet/RuView","slug":"eio-9929a8","errorCode":"EIO","errorMessage":"veil: genl_connect failed\n","messagePattern":"veil: genl_connect failed\n","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"wifi-veil/firmware/openwrt/veil_shieldd.c","lineNumber":75,"sourceCode":"    size_t          passes; /* Givens passes                                */\n    volatile sig_atomic_t running;\n};\n\nstatic struct veil_ctx g_ctx;\n\nstatic void on_signal(int sig) { (void)sig; g_ctx.running = 0; }\n\n/* ---------------------------------------------------------------------- */\n/* nl80211 bring-up — all REAL libnl-genl-3 API names.                     */\n/* ---------------------------------------------------------------------- */\nstatic int veil_nl_connect(struct veil_ctx *c) {\n    c->sock = nl_socket_alloc();\n    if (!c->sock) {\n        fprintf(stderr, \"veil: nl_socket_alloc failed\\n\");\n        return -ENOMEM;\n    }\n    if (genl_connect(c->sock)) {\n        fprintf(stderr, \"veil: genl_connect failed\\n\");\n        return -EIO;\n    }\n    c->family = genl_ctrl_resolve(c->sock, \"nl80211\");\n    if (c->family < 0) {\n        fprintf(stderr, \"veil: genl_ctrl_resolve(nl80211) failed: %d\\n\",\n                c->family);\n        return c->family;\n    }\n    /* Observe MLME events (auth/assoc, and — where the driver forwards them —\n     * action-frame notifications). Real multicast group name is \"mlme\". */\n    int grp = genl_ctrl_resolve_grp(c->sock, \"nl80211\", \"mlme\");\n    if (grp >= 0) {\n        (void)nl_socket_add_membership(c->sock, grp);\n    }\n    return 0;\n}\n\n/* ---------------------------------------------------------------------- */","sourceCodeStart":57,"sourceCodeEnd":93,"githubUrl":"https://github.com/ruvnet/RuView/blob/4685618388a5e49fad5b3005806f3bdd6a7c25c3/wifi-veil/firmware/openwrt/veil_shieldd.c#L57-L93","documentation":"Byte-identical copy of the privshield daemon inside the standalone wifi-veil workspace. `genl_connect()` attaches the socket to NETLINK_GENERIC; any failure is flattened to `-EIO` here. Real causes are environmental — AF_NETLINK blocked by seccomp/container policy, missing privileges in a user namespace, or fd exhaustion — rather than a daemon bug.","triggerScenarios":"Container run without `--net=host`/CAP_NET_ADMIN; restrictive `RestrictAddressFamilies=AF_UNIX` in a systemd unit; EMFILE from fd leaks; kernel without generic netlink.","commonSituations":"CI or laptop smoke tests of the wifi-veil build; hardened service units; chroots without netlink devices.","solutions":["Run with host network namespace and CAP_NET_ADMIN (`--net=host --cap-add NET_ADMIN`).","Loosen `RestrictAddressFamilies` to include `AF_NETLINK` in the unit file, or raise fd limits.","Cross-check with `iw list` on the same host: if that also fails, the environment blocks netlink, not the daemon."],"exampleFix":"# before\nsystemd-run ./veil_shieldd -i 2            # veil: genl_connect failed\n# after\n# unit file: RestrictAddressFamilies=AF_UNIX AF_NETLINK\nsystemctl restart veil_shieldd","handlingStrategy":"validation","validationCode":"static int netlink_available(void) {\n    struct nl_sock *t = nl_socket_alloc();\n    if (!t) return -1;\n    int rc = genl_connect(t);\n    nl_socket_free(t);\n    return rc == 0 ? 0 : -1;\n}","typeGuard":null,"tryCatchPattern":"int rc = veil_nl_connect(&g_ctx);\nif (rc == -EIO) {\n    fprintf(stderr, \"veil: netlink blocked — need host netns + CAP_NET_ADMIN\\n\");\n    exit(rc);\n}","preventionTips":["Launch with host netns and CAP_NET_ADMIN; plain containers block AF_NETLINK.","Allow AF_NETLINK in systemd sandboxing directives.","Verify `iw list` works in the exact environment before starting the daemon."],"tags":["c","openwrt","nl80211","libnl","permissions","containers"],"backgroundTag":null,"analyzedSha":"4685618388a5e49fad5b3005806f3bdd6a7c25c3","analyzedAt":"2026-08-16T06:09:40.886Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}