unslothai/unsloth · error · NativePathLeaseError

Device and virtual filesystem paths are not supported.

Error message

Device and virtual filesystem paths are not supported.

What it means

On non-Windows platforms, the granted path lives under /dev, /proc, or /sys, which _reject_network_or_device_path() rejects. These are device nodes and virtual (kernel synthesized) filesystems whose stat results, sizes, and identities do not behave like real files, so leasing them is unsafe and meaningless. The check uses Path.is_relative_to against the three roots.

Source

Thrown at studio/backend/utils/native_path_leases.py:413

        _NATIVE_PATH_REDACTIONS.append(path)
        del _NATIVE_PATH_REDACTIONS[:-_MAX_NATIVE_PATH_REDACTIONS]


def _reject_network_or_device_path(path: Path) -> None:
    text = str(path)
    if os.name == "nt":
        normalized = text.replace("/", "\\").lower()
        if normalized.startswith("\\\\?\\"):
            rest = normalized[4:]
            is_local_drive = len(rest) >= 3 and rest[0].isalpha() and rest[1:3] == ":\\"
            if not is_local_drive:
                raise NativePathLeaseError("Network paths are not supported for native grants.")
        elif normalized.startswith("\\\\"):
            raise NativePathLeaseError("Network paths are not supported for native grants.")
    if os.name != "nt":
        for root in ("/dev", "/proc", "/sys"):
            if path.is_relative_to(root):
                raise NativePathLeaseError("Device and virtual filesystem paths are not supported.")
    if "\x00" in text:
        raise NativePathLeaseError("Native path contains invalid characters.")


def _b64decode(value: str) -> bytes:
    try:
        padding = "=" * (-len(value) % 4)
        return base64.urlsafe_b64decode((value + padding).encode("ascii"))
    except (UnicodeEncodeError, binascii.Error, ValueError) as exc:
        raise NativePathLeaseError("Native path grant has an invalid format.") from exc


def _same_native_path(resolved: Path, signed: Path) -> bool:
    try:
        return resolved.samefile(signed)
    except OSError:
        return os.path.normcase(str(resolved)) == os.path.normcase(str(signed))

View on GitHub (pinned to 203007d190)

Solutions

1. Select a regular file on a real filesystem (ext4/apfs/tmpfs-backed home dir) instead of /dev, /proc, or /sys.
2. If you need device content (e.g. disk image), create a file copy first (dd to a file) and select that.
3. If the picker allowed choosing these, file a bug to filter those roots in the file dialog.
4. Check whether a symlink resolved into /proc (fd targets) and re-select the underlying real file.

Example fix

# before
selected: /proc/self/fd/42 -> resolves under /proc -> rejected

# after
$ cp /target/of/fd42 ~/model.gguf   # materialize real file
select ~/model.gguf

from pathlib import Path

REJECTED_ROOTS = ('/dev', '/proc', '/sys')

def is_supported_native_path(path: str) -> bool:
    p = Path(path)
    return not any(p.is_relative_to(root) for root in REJECTED_ROOTS)

from pathlib import Path

def is_real_filesystem_path(path: str) -> bool:
    p = Path(path)
    return p.is_absolute() and not any(
        p.is_relative_to(root) for root in ('/dev', '/proc', '/sys')
    )

try:
    grant = verify_native_path_lease(lease, operation='read')
except NativePathLeaseError as exc:
    if 'Device and virtual filesystem' in str(exc):
        return respond(400, 'Select a real file on disk; /dev, /proc and /sys are unsupported.')
    raise

When it happens

Trigger: verify_native_path_lease() on Linux/macOS with canonical_path under the three roots: selecting /dev/zero or a serial device as a 'file'; /proc/self/fd/... descriptors; /sys/... config pseudo-files; a fuzz test or path input box that accepted /dev entries.

Common situations: Manual path entry instead of the picker allowing /dev paths; scripts pointing at device nodes; symlinks resolved into /proc (e.g. /proc/self/fd/N) after resolve(strict=True); users trying to read GPU/disk device nodes directly.

Related errors

• VirusTotal request failed after {max_attempts} attempt(s): {
• Non-GGUF diffusion loads are restricted to unsloth/* repos (
• base_repo is restricted to unsloth/* repos (or a local path)
• {_cn_fs.reason}
• this torch cannot register the pre-quant constructor allowli

AI-assisted analysis of unslothai/unsloth@203007d190 (2026-08-15). Data as JSON: /api/errors/99a50e27022e22ea. Report an issue: GitHub.