Hello!

I have recently started to have issues when starting libvirt, which starts dnsmasq for DHCP and local machine DNS.

I have started seeing inotify sockets failures in multiple packages. But the thing is, I cannot start libvirt network now. I think inotify socket should not usually be cause of fatal error.

sudo virsh net-start default ends always with this failure. It usually helps to reboot the machine. I am not sure how to identify inotify usage on my machine.

Strange is this seems to be problem only of root user.

$ sudo inotifywatch /etc/resolv.conf
Establishing watches...
Failed to watch /etc/resolv.conf; upper limit on inotify watches reached!

$ inotifywatch /etc/resolv.conf
Establishing watches...
Finished establishing watches, now collecting statistics.

Strange is number of user watches should be somehow high:

$ cat /proc/sys/fs/inotify/max_user_watches
511013

So I started thinking, should be a failure to initialize inotify socket a fatal error? It seems to me warning would be all right.

dnsmasq supports running even without inotify support. I have created a modification to run even in that case, only emit warning. I think failure to observe resolv.conf changes should not be a fatal error, unless requested somehow more explicitly.

In attached change, I retry inotify creation with dropped privileges. It might help in my case and even for others. First time it fails only silently, because logging is not yet prepared. Only second time it also logs warnings.

Minor change is making more obvious difference between main inotify socket and inotify watch creation error.

Regards,
Petr

--
Petr Menšík
Senior Software Engineer, RHEL
Red Hat, https://www.redhat.com/
PGP: DFCF908DB7C87E8E529925BC4931CA5B6C9FC5CB

From 3c65be1c4e9aa31bdd5447bc633c1cd5474e9633 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <[email protected]>
Date: Wed, 11 Feb 2026 22:02:48 +0100
Subject: [PATCH] Make inotify initialization non-fatal error
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

When inotify watch creation is not successful, print only warning. Retry
after dropping privileges because that might help too. Log warning only
the second time, when logging is properly initialized.

Signed-off-by: Petr Menšík <[email protected]>
---
 src/dnsmasq.c | 13 +++++++++++--
 src/dnsmasq.h |  2 +-
 src/inotify.c | 22 ++++++++++++++++------
 3 files changed, 28 insertions(+), 9 deletions(-)

diff --git a/src/dnsmasq.c b/src/dnsmasq.c
index 7dbefc4c..0f46eb98 100644
--- a/src/dnsmasq.c
+++ b/src/dnsmasq.c
@@ -440,7 +440,7 @@ int main (int argc, char **argv)
 #ifdef HAVE_INOTIFY
   if ((daemon->port != 0 && !option_bool(OPT_NO_RESOLV)) ||
       daemon->dynamic_dirs)
-    inotify_dnsmasq_init();
+    inotify_dnsmasq_init(0);
   else
     daemon->inotifyfd = -1;
 #endif
@@ -864,6 +864,15 @@ int main (int argc, char **argv)
     }
 #endif
 
+#ifdef HAVE_INOTIFY
+  /* inotify creation failed for the root user.
+   * Retry with unprivileged user, log warnings this time. */
+  if (daemon->inotifyfd == -1 &&
+      ((daemon->port != 0 && !option_bool(OPT_NO_RESOLV)) ||
+       daemon->dynamic_dirs))
+    inotify_dnsmasq_init(1);
+#endif
+
    /* Don't start logging malloc before logging is set up. */
   daemon->log_malloc = option_bool(OPT_LOG_MALLOC);
   
@@ -1295,7 +1304,7 @@ int main (int argc, char **argv)
 	  check_ubus_listeners();
 	}
 #endif
-      
+
       if (daemon->port != 0)
 	check_dns_listeners(now);
 
diff --git a/src/dnsmasq.h b/src/dnsmasq.h
index 1c001a83..d0990107 100644
--- a/src/dnsmasq.h
+++ b/src/dnsmasq.h
@@ -1905,7 +1905,7 @@ int detect_loop(char *query, int type);
 
 /* inotify.c */
 #ifdef HAVE_INOTIFY
-void inotify_dnsmasq_init(void);
+void inotify_dnsmasq_init(int log_warn);
 int inotify_check(time_t now);
 void set_dynamic_inotify(int flag, int total_size, struct crec **rhash, int revhashsz);
 #endif
diff --git a/src/inotify.c b/src/inotify.c
index f70daead..d01b416c 100644
--- a/src/inotify.c
+++ b/src/inotify.c
@@ -85,18 +85,22 @@ static char *my_readlink(char *path)
     }
 }
 
-void inotify_dnsmasq_init()
+void inotify_dnsmasq_init(int log_warn)
 {
   struct resolvc *res;
   inotify_buffer = safe_malloc(INOTIFY_SZ);
   daemon->inotifyfd = inotify_init1(IN_NONBLOCK | IN_CLOEXEC);
-  
+
   if (daemon->inotifyfd == -1)
-    die(_("failed to create inotify: %s"), NULL, EC_MISC);
+    {
+      if (log_warn)
+        my_syslog(LOG_WARNING, _("failed to create inotify: %s"), strerror(errno));
+      return;
+    }
 
   if (daemon->port == 0 || option_bool(OPT_NO_RESOLV))
     return;
-  
+
   for (res = daemon->resolv_files; res; res = res->next)
     {
       char *d, *new_path, *path = safe_malloc(strlen(res->name) + 1);
@@ -127,8 +131,14 @@ void inotify_dnsmasq_init()
 	    die(_("directory %s for resolv-file is missing, cannot poll"), res->name, EC_MISC);
 	}	  
 	 
-      if (res->wd == -1)
-	die(_("failed to create inotify for %s: %s"), res->name, EC_MISC);
+      if (res->wd == -1) {
+	free(path);
+	if (log_warn)
+	  my_syslog(LOG_WARNING, _("failed to create inotify watch for %s: %s"), res->name, strerror(errno));
+	close(daemon->inotifyfd);
+	daemon->inotifyfd = -1;
+	return;
+      }
 	
     }
 }
-- 
2.53.0

_______________________________________________
Dnsmasq-discuss mailing list
[email protected]
https://lists.thekelleys.org.uk/cgi-bin/mailman/listinfo/dnsmasq-discuss