{"record":{"id":"9f93b52ef2d339b7","repo":"shadowsocks/shadowsocks-rust","slug":"open-dev-pf-err","errorCode":null,"errorMessage":"open /dev/pf {err}","messagePattern":"open /dev/pf (.+?)","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"crates/shadowsocks-service/src/local/redir/sys/unix/bsd_pf.rs","lineNumber":376,"sourceCode":"        )))\n    }\n}\n\nimpl Drop for PacketFilter {\n    fn drop(&mut self) {\n        unsafe {\n            libc::close(self.fd);\n        }\n    }\n}\n\npub static PF: LazyLock<PacketFilter> = LazyLock::new(|| match PacketFilter::open() {\n    Ok(pf) => pf,\n    Err(err) if err.kind() == ErrorKind::PermissionDenied => {\n        panic!(\"open /dev/pf permission denied, consider restart with root user\");\n    }\n    Err(err) => {\n        panic!(\"open /dev/pf {err}\");\n    }\n});\n","sourceCodeStart":358,"sourceCodeEnd":379,"githubUrl":"https://github.com/shadowsocks/shadowsocks-rust/blob/8eb0f0a65b1d976ab6bed5787327ef86529b0435/crates/shadowsocks-service/src/local/redir/sys/unix/bsd_pf.rs#L358-L379","documentation":"Same lazy /dev/pf initialization as the permission-denied variant, but for any other I/O error while opening the packet filter device. The message embeds the underlying `err` (e.g. ENOENT when /dev/pf does not exist). The program panics because the BSD redir cannot function without pf.","triggerScenarios":"First access of `static PF` in bsd_pf.rs triggers `PacketFilter::open()` and it fails with a non-PermissionDenied io::Error, producing `panic!(\"open /dev/pf {err}\")`.","commonSituations":"pf kernel module not loaded (/dev/pf missing, ENOENT); running inside a container/jail without pf device; kernel built without pf support; device node permissions/ownership broken.","solutions":["Load the pf kernel module / enable pf so /dev/pf exists (`pfctl -e`, `kldload pf`)","Run on the host or configure the jail/container to expose /dev/pf","Verify the device node exists: ls -l /dev/pf, recreate via MAKEDEV if needed","Inspect the embedded io::Error message for the exact underlying cause"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"# verify /dev/pf exists and is openable before start:\ntest -e /dev/pf || (kldload pf; pfctl -e)","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Assert pf availability in the service's ExecStartPre","Avoid running pf-dependent binaries inside jails/containers without /dev/pf","Keep kernel pf module loaded at boot (/boot/loader.conf: pf_load=\"YES\")","Log the full io::Error from startup for diagnosis"],"tags":["panic","bsd","pf-firewall","device-open"],"backgroundTag":"file-open-failed","analyzedSha":"8eb0f0a65b1d976ab6bed5787327ef86529b0435","analyzedAt":"2026-09-09T12:20:43.168Z","contentChangedAt":"2026-09-09T12:20:43.168Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}