Warp: Failed to increase the number of allowed open FDs

Zero Trust WARP
1

I have been using warp for a while with my Mac. Today I installed it on Linux and it seems to work for the first few minutes, I switched to local proxy mode, then it stopped working. Checking the logs, I found this:

2022-12-27T22:29:47.985Z  INFO main_loop: warp::warp: Initiate WARP proxy connection
2022-12-27T22:29:47.985Z DEBUG main_loop: warp::warp: Connect finished Err(InsufficientResources("Failed to increase the number of allowed open FDs: EPERM: Operation not permitted"))
2022-12-27T22:29:47.985Z  WARN main_loop: warp::warp_service: Tunnel failed to start error=InsufficientResources("Failed to increase the number of allowed open FDs: EPERM: Operation not permitted")
2022-12-27T22:29:47.985Z DEBUG main_loop: warp::warp_service: Entering main loop arm arm="tunnel_taskset_errors_fut"
2022-12-27T22:29:47.985Z DEBUG main_loop: warp::warp_service: Entering main loop arm arm="status_change"
2022-12-27T22:29:47.985Z  INFO main_loop: warp::warp_service: WARP status: Disconnected
2022-12-27T22:29:47.985Z DEBUG main_loop: warp::warp_service::ipc_handlers: Sending IPC status update: Disconnected
2022-12-27T22:29:47.985Z DEBUG main_loop: warp::warp_service::ipc_handlers: Ipc Broadcast ResponseStatus: Disconnected
2022-12-27T22:29:47.985Z DEBUG main_loop: warp::warp_service: Entering main loop arm arm="conn_error"
2022-12-27T22:29:47.985Z DEBUG main_loop: warp::warp_service: Reconnecting on connection error
2022-12-27T22:29:47.986Z DEBUG main_loop: warp::firewall: Firewall stopped
2022-12-27T22:29:47.986Z  INFO main_loop: warp::warp_service: captive_portal_fw_until: Indefinitely

any idea what is the issue here and how to bypass given that I don’t want to increase the fd limits too high?

2

Did a bit of reverse engineering work and figured out that Warp uses setrlimit function at some point. Hooking this function makes it work :slight_smile:

3

Same issue here. Would you please give more details on how you fixed it? I have got no clues. Tons of thanks.

4

just add “CAP_SYS_RESOURCE” to CapabilityBoundingSet and AmbientCapabilities in /lib/systemd/system/warp-svc.service, then restart the service, I’m using debian btw.

[Unit]
Description=Cloudflare Zero Trust Client Daemon
After=pre-network.target

[Service]
Type=simple
ExecStart=/bin/warp-svc
DynamicUser=no
CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_SYS_PTRACE CAP_SYS_RESOURCE
AmbientCapabilities=CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_SYS_PTRACE CAP_SYS_RESOURCE
StateDirectory=cloudflare-warp
RuntimeDirectory=cloudflare-warp
LogsDirectory=cloudflare-warp
Restart=always