astrid-runtime/astrid · error

FSKit service control path is not the kernel endpoint

Error message

FSKit service control path is not the kernel endpoint

What it means

validate_control_path enforces that the control socket lives exactly at resource_path/process-control.sock, the fixed kernel endpoint. Any other location breaks the kernel's discovery contract and is rejected after redirect checks.

Solutions

1. Set control_path to resource_path.join("process-control.sock")
2. Regenerate the service launch config using the provider defaults
3. Remove overrides of the control path in config/templates

Example fix

// before
control_path: PathBuf::from("/run/fskit/ctl.sock")
// after
control_path: launch.lease.resource_path.join("process-control.sock")

fn control_at_kernel_endpoint(lease: &StorageMountLeaseV1, control: &std::path::Path) -> bool {
    control == lease.resource_path.join("process-control.sock")
}

When it happens

Trigger: validate_launch supplies a control_path that is absolute and clean but differs from resource_path.join("process-control.sock") — e.g. a custom socket filename or a path under another directory.

Common situations: Hand-edited service configs renaming the socket; moving the control socket to /tmp or a run directory; providers generated by older versions with a different naming scheme.

Understand the failure class

Background: "Must be a positive integer", "Invalid value", "Unsupported": the invalid-argument-value error family, when a library rejects the value you pass — this error's family across 35 libraries.

Related errors

• FSKit callback path is not the kernel lease endpoint
• FSKit lease callback token is invalid
• FSKit lease manifest exceeds the bounded size
• FSKit lease paths must be absolute
• FSKit service control endpoint is already present

AI-assisted analysis of astrid-runtime/astrid@affd8760f4 (2026-09-09). Data as JSON: /api/errors/1ea4d9387879979a. Report an issue: GitHub.

Appendix: source

Thrown at crates/astrid-storage-provider-fskit/src/service.rs:198

}

fn validate_control_path(control_path: &Path, resource_path: &Path) -> Result<()> {
    if !control_path.is_absolute()
        || control_path
            .components()
            .any(|component| matches!(component, std::path::Component::ParentDir))
    {
        bail!("FSKit service control path is malformed");
    }
    let parent = control_path
        .parent()
        .context("FSKit service control path has no parent")?;
    platform_fs::validate_private_directory(parent)
        .context("validate private FSKit control parent")?;
    platform_fs::verify_no_redirects(control_path)
        .context("reject redirected FSKit control path")?;
    if control_path != resource_path.join("process-control.sock") {
        bail!("FSKit service control path is not the kernel endpoint");
    }
    if local_transport::endpoint_is_present(control_path)
        .context("inspect FSKit service control endpoint")?
    {
        bail!("FSKit service control endpoint is already present");
    }
    Ok(())
}

fn bind_control(path: &Path) -> Result<LocalListener> {
    local_transport::bind(path)
        .with_context(|| format!("bind FSKit service control {}", path.display()))
}

async fn probe_callback(launch: &StorageProviderServiceLaunchV1) -> Result<()> {
    let mut stream = local_transport::connect(&launch.lease.callback_path)
        .await
        .context("connect FSKit lease callback")?;

View on GitHub (pinned to affd8760f4)