9.3 resolvd Cannot Be Reached

2 min read

9.3.1 resolvd is not running #

peinit restarts resolvd whenever it exits (§2.1). The new process removes the socket the old one left and binds a fresh one (§2.4), so an outage after a crash lasts only until the restart completes. If resolvd keeps exiting, the cause is one of the startup failures below.

9.3.2 resolvd will not start #

The startup failures are fatal and logged before the exit (§2.2):

• stub listener on 127.0.0.53:53: <error>: either the port reservation for tcp,udp:53 is not in the registry — its seed is inert until the image applies it (§2.1) — or something else already holds 127.0.0.53:53. The error text says which.
• native socket: <error>: /run/resolvd could not be created or given its mode, a stale socket file could not be removed, or the socket could not be bound or set up.

Because the restart policy is Always, a failure that persists is a restart loop: the same line in the log each time.

9.3.3 The native door is closed to ordinary programs #

Looks like: getaddrinfo fails with NO_RECOVERY for every name but localhost, for every user but SYSTEM and administrators, while programs that send DNS to 127.0.0.53 themselves work.

Two causes:

• The socket's descriptor could not be written at startup (§2.4), and the log has the could not set a descriptor line. Ordinary programs cannot reach the socket at all.
• ControlSecurity holds a valid descriptor that does not grant RESOLVER_QUERY to them (§5.2). They reach the socket and are denied: resolv query prints resolv: access denied. Deleting the value restores the compiled default without a restart (§2.3).

The stub listener is not governed by either, which is why direct DNS clients are unaffected.

Edit this page