Avahi/mDNS broken in Scarab unless using --no-drop-root

[NotHugo37]

Knulli build version

scarab 2026/05/11 21:44

Your architecture

TRIMUI Smart Pro, TRIMUI Brick

Issue description

mDNS hostname resolution no longer works in Scarab.

The device is reachable normally via IP address (SSH/SFTP/Syncthing all work), but hostname.local does not resolve anymore.

This worked correctly in Gladiator II on the same hardware/network/client setup.

Detailed reproduction steps

1. Install/use Scarab on TrimUI Smart Pro or TrimUI Brick
2. Set a hostname (example: SmartPro)
3. Connect the device to Wi-Fi
4. Verify the hostname appears correctly in the router DHCP client list
5. Attempt to access:

Using PuTTY:
ssh root@SmartPro.local
ssh root@SmartPro

Using WinSCP:
sftp://SmartPro.local
sftp://SmartPro

Syncthing web UI:
http://SmartPro.local:8384
http://SmartPro:8384

6. Observe that hostname resolution fails, while direct IP access works normally

Additional findings:

• avahi-daemon -D exits immediately
• no avahi process remains running
• multicast support is present on wlan0
• D-Bus is running correctly

Running:

avahi-daemon --debug

Produces:

Found user 'avahi' (UID 100) and group 'avahi' (GID 101).
Successfully dropped root privileges.
avahi-daemon 0.8 starting up.
WARNING: No NSS support for mDNS detected, consider installing nss-mdns!
Successfully called chroot().
Successfully dropped remaining capabilities.
No service file found in /etc/avahi/services.
socket() failed: Permission denied
socket() failed: Permission denied
Failed to create server: No suitable network protocol available
avahi-daemon 0.8 exiting.

However, running:

avahi-daemon --no-drop-root --debug

works correctly and produces:

Joining mDNS multicast group on interface wlan0.IPv4 with address ...
Server startup complete. Host name is SmartPro.local.

After running with --no-drop-root:

• hostname.local works correctly
• SFTP hostname access works
• Syncthing hostname access works

Details of any attempts to fix this yourself

Verified multicast support on wlan0 using:

ip link
ip maddr

Verified D-Bus is running:

ps aux | grep dbus

Tested manual Avahi startup
Confirmed issue only occurs after Avahi drops privileges

Details of any modifications you have made to Knulli.

No permanent modifications before testing, except changing the hostname from the default KNULLI to SmartPro or Brick.

Temporary workaround used:

Create a custom.sh file in /userdata/system/ with the following content:

#!/bin/sh

killall avahi-daemon 2>/dev/null
avahi-daemon --no-drop-root -D

Logs and data

No response

[fedekrum]

Additional root-cause analysis (TrimUI Smart Pro, Scarab)

Same failure here. --no-drop-root works because Avahi never drops to user avahi, which is exactly where it breaks on stock Scarab.

Why TrimUI but not Anbernic (same Scarab build):

	TrimUI Smart Pro	Anbernic RG40XX-H
CONFIG_ANDROID_PARANOID_NETWORK	=y	not set
Avahi at boot	fails	avahi-daemon: running [*.local]
/etc/group inet / net_raw	missing on stock image	also missing, but kernel doesn't require them
avahi-daemon binary	same MD5 as RG40XX-H	same

After Avahi drops privileges, user avahi (only in group avahi) cannot open sockets → socket() failed: Permission denied. Root SSH/Wi‑Fi still work. Boot order S07network → S08connman → S50avahi-daemon is fine — not a timing issue.

Alternative workaround (keeps dropped privileges):

Add to /etc/group:

inet:x:3003:root,avahi
net_raw:x:3004:root,avahi

Then:

/etc/init.d/S05avahi-setup.sh start
killall avahi-daemon 2>/dev/null
/etc/init.d/S50avahi-daemon start
knulli-save-overlay   # persist across reboot

Verified on TrimUI Smart Pro: after overlay + reboot, trimui.local resolves and avahi-daemon: running [trimui.local] with normal privilege dropping.

Related build-side tracking: knulli-cfw/distribution#136 (suggested fix: ship those group entries in TrimUI H700 fsoverlay).

[xikteny]

Just adding another confirmation of this, on a Brick running Scarab.

See here for a few details on this (just in case this category of problem could be relevant for something else, like Bluetooth): https://elinux.org/Android_Security#Paranoid_network-ing

Group #define	GID	Capability
AID_NET_BT_ADMIN	3001	Can create an RFCOMM, SCO, or L2CAPP Bluetooth socket
AID_NET_BT	3002	Can create a Bluetooth socket
AID_INET	3003	Can create IPv4 or IPv6 socket
AID_NET_RAW	3004	Can create certain kinds of IPv4 sockets??
AID_NET_ADMIN	3005	Allow CAP_NET_ADMIN permissions for process

[root@KNULLI /userdata/system]# zgrep PARANOID /proc/config.gz
CONFIG_ANDROID_PARANOID_NETWORK=y

[root@KNULLI /userdata/system]# avahi-daemon
Found user 'avahi' (UID 100) and group 'avahi' (GID 101).
Successfully dropped root privileges.
avahi-daemon 0.8 starting up.
WARNING: No NSS support for mDNS detected, consider installing nss-mdns!
Successfully called chroot().
Successfully dropped remaining capabilities.
No service file found in /etc/avahi/services.
socket() failed: Permission denied
socket() failed: Permission denied
Failed to create server: No suitable network protocol available
avahi-daemon 0.8 exiting.

[root@KNULLI /userdata/system]# echo "inet:x:3003:root,avahi" >> /etc/group
[root@KNULLI /userdata/system]# echo "net_raw:x:3004:root,avahi" >> /etc/group

[root@KNULLI /userdata/system]# avahi-daemon
Found user 'avahi' (UID 100) and group 'avahi' (GID 101).
Successfully dropped root privileges.
avahi-daemon 0.8 starting up.
WARNING: No NSS support for mDNS detected, consider installing nss-mdns!
Successfully called chroot().
Successfully dropped remaining capabilities.
No service file found in /etc/avahi/services.
Joining mDNS multicast group on interface wlan0.IPv4 with address 192.168.1.221.
New relevant interface wlan0.IPv4 for mDNS.
Joining mDNS multicast group on interface lo.IPv6 with address ::1.
New relevant interface lo.IPv6 for mDNS.
Joining mDNS multicast group on interface lo.IPv4 with address 127.0.0.1.
New relevant interface lo.IPv4 for mDNS.
Network interface enumeration completed.
Registering new address record for 192.168.1.221 on wlan0.IPv4.
Registering new address record for ::1 on lo.*.
Registering new address record for 127.0.0.1 on lo.IPv4.
Server startup complete. Host name is KNULLI.local. Local service cookie is 1012130544.