Stream: cargo-component

Topic: ✔ WASMTIME SOCKET Access Denied

Joshua Aruokhai (May 27 2024 at 13:32):

Hello i created a component to test socket

#[allow(warnings)]
mod bindings;
use std::{fs::File, net::{IpAddr, Ipv4Addr, SocketAddr}, result};
use wasi::sockets::{network::{IpSocketAddress, Ipv4SocketAddress}, tcp::Network, tcp_create_socket::create_tcp_socket, *};
use wasi::sockets::tcp::ErrorCode;

use bindings::Guest;

struct Component;

impl Guest for Component {
    /// Say hello!
    fn create_tcp() -> String {
        let mut listener = create_tcp_socket(network::IpAddressFamily::Ipv4).unwrap();
        let socketaddress = IpSocketAddress::Ipv4(Ipv4SocketAddress{ port: 9000, address: (127,0,0,1) });
        listener.start_bind(&instance_network::instance_network(), socketaddress).unwrap();
        let sub = listener.subscribe();
        loop {
            match listener.finish_bind() {
                Err(ErrorCode::WouldBlock) => sub.block(),
                _ => panic!("failure"),
            }
        }
        "Hello".to_string()
    }
}

bindings::export!(Component with_types_in bindings);

when i tried to run with command wasmtime run target/wasm32-wasi/release/wasi_socket.wasm
It outputs error :

thread 'main' panicked at src/main.rs:13:79:
called `Result::unwrap()` on an `Err` value: ErrorCode { code: 1, name: "access-denied", message: "Access denied.\n\n            POSIX equivalent: EACCES, EPERM" }
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace
Error: failed to run main module `target/wasm32-wasi/release/wasi_socket.wasm`

Bailey Hayes (May 28 2024 at 13:28):

I believe this is from not enabling the WASI CLI world set of capabilities. Add the following to your wasmtime run: -scli https://github.com/bytecodealliance/wasmtime/blob/main/src%2Fcommands%2Fserve.rs

Joshua Aruokhai (May 29 2024 at 06:47):

Bailey Hayes said:

I believe this is from not enabling the WASI CLI world set of capabilities. Add the following to your wasmtime run: -scli https://github.com/bytecodealliance/wasmtime/blob/main/src%2Fcommands%2Fserve.rs

I tried your suggestion, it still outputted the same error.

Joshua Aruokhai (May 29 2024 at 07:14):

Joshua Aruokhai said:

Bailey Hayes said:

I believe this is from not enabling the WASI CLI world set of capabilities. Add the following to your wasmtime run: -scli https://github.com/bytecodealliance/wasmtime/blob/main/src%2Fcommands%2Fserve.rs

I tried your suggestion, it still outputted the same error.

In my opinion, i think something is wrong with this line of code instance_network::instance_network() . When i also tried to resolve ip from address ip_name_lookup::resolve_addresses(network, name)?;, there was also an error specifically PermanentError .

Roman Volosatovs (May 29 2024 at 13:05):

Hey @Joshua Aruokhai , it looks like the Wasmtime environment you are using does not have access to host network, which is why you're getting the "access denied" (networking is not allowed in the sandbox you're using)

Could you try to run your component with:

wasmtime run -S cli=y -S inherit-network=y ./component.wasm

You can see most of the flags documented via:

wasmtime run -S help-long

Joshua Aruokhai (May 30 2024 at 05:57):

Thanks a lot, this actually worked, I tried it before, maybe I did something wrong.

Notification Bot (Jun 14 2024 at 12:52):

Till Schneidereit has marked this topic as resolved.

Last updated: Nov 25 2024 at 19:03 UTC