status 1, errno = 13: permission denied

Brandon Heller

unread,

Nov 2, 2013, 4:09:57 AM11/2/13

to tunnelbli...@googlegroups.com

On the surface at least, my problem seems similar to this one:

https://groups.google.com/forum/#!topic/tunnelblick-discuss/egvEhaXTsV0

I'm unable to connect to the VPN. I'm running Mavericks and Tunnelblick 3.4beta14 (build 3649). Here's the main error when I try to connect to the VPN:

Could not start OpenVPN (openvpnstart returned with status #236)

Contents of the openvpnstart log:

*Tunnelblick: openvpnstart log:

OpenVPN returned with status 1, errno = 13:

Permission denied

The permissions for the directory at which 'cd' fails when trying to launch openvpn do seem to be set for root, but if I try to override these, Tunnelblick asks for the Admin password and resets the permissions:

cd /Library/Application\ Support/Tunnelblick/Shared/

brandonh-macbook:Shared brandonh$ sudo ls -la [XXXX]VPN.tblk/

total 0

drwxr-x--- 3 root wheel 102 Nov 2 00:28 .

drwxr-xr-x 3 root wheel 102 Nov 2 00:28 ..

drwxr-x--- 3 root wheel 102 Nov 2 00:28 Contents

Console log end and Console output below. Any help debugging this would be greatly appreciated! I've tried converting the .ovpn file to unix line endings, installing for just my user vs all users, and reinstalling, and I get the same result every time.

Thanks,

-b

-------

End of console log:

11/2/13 12:53:06.511 AM openvpn[67363]: Exiting

11/2/13 12:53:14.062 AM openvpn[67370]: --mtu-disc is not supported on this OS

11/2/13 12:53:14.062 AM openvpn[67370]: Exiting due to fatal error

---------

*Tunnelblick: OS X 10.9.0; Tunnelblick 3.4beta14 (build 3649); Admin user

"Sanitized" configuration file for /Library/Application Support/Tunnelblick/Shared/[XXXX].tblk:

client

dev tun

proto udp

remote office.[XXXX]networks.com 1194

resolv-retry infinite

nobind

persist-key

persist-tun

comp-lzo

verb 3

cipher aes-256-cbc

auth sha256

tun-mtu 1400

mtu-disc yes

remote-cert-tls server

tls-remote office.[XXXX]networks.com

<ca>

[Security-related line(s) omitted]

</ca>

<cert>

[Security-related line(s) omitted]

</cert>

<key>

[Security-related line(s) omitted]

</key>

================================================================================

Tunnelblick Log:

2013-11-02 00:12:43 *Tunnelblick: OS X 10.9.0; Tunnelblick 3.4beta14 (build 3649)

2013-11-02 00:12:43 *Tunnelblick: Attempting connection with [XXXX]; Set nameserver = 1; monitoring connection

2013-11-02 00:12:43 *Tunnelblick: openvpnstart start [XXXX].tblk 1337 1 0 3 0 305 -ptADGNWradsgnw 2.2.1

2013-11-02 00:12:43 *Tunnelblick:

Could not start OpenVPN (openvpnstart returned with status #236)

Contents of the openvpnstart log:

*Tunnelblick: openvpnstart log:

Loading tun-signed.kext

OpenVPN returned with status 1, errno = 13:

Permission denied

Command used to start OpenVPN (one argument per displayed line):

/Applications/Tunnelblick.app/Contents/Resources/openvpn/openvpn-2.2.1/openvpn

--cd

/Library/Application Support/Tunnelblick/Shared/[XXXX].tblk/Contents/Resources

--daemon

--management

127.0.0.1

1337

--config

/Library/Application Support/Tunnelblick/Shared/[XXXX].tblk/Contents/Resources/config.ovpn

--log

/Library/Application Support/Tunnelblick/Logs/-SLibrary-SApplication Support-STunnelblick-SShared-S[XXXX].tblk-SContents-SResources-Sconfig.ovpn.1_0_3_0_305.1337.openvpn.log

--management-query-passwords

--management-hold

--script-security

2

--up

/Applications/Tunnelblick.app/Contents/Resources/client.up.tunnelblick.sh -m -w -d -f -ptADGNWradsgnw

--down

/Applications/Tunnelblick.app/Contents/Resources/client.down.tunnelblick.sh -m -w -d -f -ptADGNWradsgnw

--up-restart

Contents of the OpenVPN log:

More details may be in the Console Log's "All Messages"

================================================================================

Console Log:

2013-11-02 00:11:07 Tunnelblick[66762] DEBUG: Updater: systemVersion 10.9.0 satisfies minimumSystemVersion 10.4.0

2013-11-02 00:12:26 Tunnelblick[66762] Configuration installer: CR characters are being removed or replaced with LF characters in the installed copy of /Users/brandonh/Desktop/[XXXX].tblk/[XXXX].ovpn

2013-11-02 00:12:37 Tunnelblick[66762] Beginning installation or repair

2013-11-02 00:12:37 authexec[66787] executing /Applications/Tunnelblick.app/Contents/Resources/installer

2013-11-02 00:12:37 Tunnelblick[66762] Installation or repair succeeded; Log:

Tunnelblick installer started 2013-11-02 00:12:37. 3 arguments: 0x0001 /Library/Application Support/Tunnelblick/Shared/[XXXX].tblk /private/var/folders/g6/_1837f_s21n2v7818dy0b9c00000gn/T/TunnelblickTemporaryDotTblk-6FvX8P/[XXXX].tblk

Copied /private/var/folders/g6/_1837f_s21n2v7818dy0b9c00000gn/T/TunnelblickTemporaryDotTblk-6FvX8P/[XXXX].tblk to /Library/Application Support/Tunnelblick/Shared/[XXXX].tblk.temp

Copied /Library/Application Support/Tunnelblick/Shared/[XXXX].tblk.temp to /Library/Application Support/Tunnelblick/Shared/[XXXX].tblk

Changed ownership of /Library/Application Support/Tunnelblick/Shared/[XXXX].tblk and its contents from 501:20 to 0:0

Changed permissions from 755 to 750 on /Library/Application Support/Tunnelblick/Shared/[XXXX].tblk

Changed permissions from 755 to 750 on /Library/Application Support/Tunnelblick/Shared/[XXXX].tblk/Contents

Changed permissions from 755 to 750 on /Library/Application Support/Tunnelblick/Shared/[XXXX].tblk/Contents/Resources

Changed permissions from 644 to 600 on /Library/Application Support/Tunnelblick/Shared/[XXXX].tblk/Contents/Resources/config.ovpn

2013-11-02 00:12:39 Tunnelblick[66762] setupPerConfigOpenvpnVersion: Invalid openvpnVersionIx 0; maximum is -1

jkbull...gmail.com

unread,

Nov 2, 2013, 8:02:26 AM11/2/13

to tunnelbli...@googlegroups.com, brandon...@gmail.com

Despite the error message for the error code returned by OpenVPN ("Permission denied"), this usually has nothing to do with file or folder permissions. What OpenVPN means when it says "permission denied" is that permission to open a VPN connection is denied.

This is usually caused by a problem in the OpenVPN configuration file itself.

There is also the following message:

11/2/13 12:53:14.062 AM openvpn[67370]: --mtu-disc is not supported on this OS

That is the problem. Your configuration file includes a line:

mtu-disc yes

and OpenVPN is saying that that option is not supported on OS X. The OpenVPN man page says:

--mtu-disc type
Should we do Path MTU discovery on TCP/UDP channel? Only supported on OSes such as Linux that supports the necessary system call to set.
'no' -- Never send DF (Don't Fragment) frames
'maybe' -- Use per-route hints
'yes' -- Always DF (Don't Fragment)

So apparently that option is not supported on OS X. Remove the line with that option from your configuration file, and try to connect again.

(The "tun-mtu 1400" may also be problematic. Be sure you understand what it does.)

Brandon Heller

unread,

Nov 2, 2013, 1:04:24 PM11/2/13

to jkbull...gmail.com, tunnelbli...@googlegroups.com

Thanks for the fast, clear reply!

After removing and re-adding the ovpn file with the mtu line updated:

mtu-disc no

I got the same error printed in the console log. Given the help output for openvpn, I thought this would work.

But, if I delete the line entirely, I no longer get that error and can connect to the VPN. However, the VPN connection breaks my normal Internet connection, which is the next thing to fix :-)

Also, I would like to report an unrelated bug. When deleting the sole tunnelblick VPN entry with the minus button, it produces this error:

"Tunnelblick encountered a fatal error.

Reinstalling Tunnelblick may fix this problem. The problem was:

Received fatal signal 5."

Here is the console log:

2013-11-02 09:36:50 Tunnelblick[67333] Beginning installation or repair

2013-11-02 09:36:50 authexec[68939] executing /Applications/Tunnelblick.app/Contents/Resources/installer

2013-11-02 09:36:51 Tunnelblick[67333] Installation or repair succeeded; Log:

Tunnelblick installer started 2013-11-02 09:36:51. 2 arguments: 0x2001 /Users/brandonh/Library/Application Support/Tunnelblick/Configurations/[XXXX]VPN.tblk

removed /Users/brandonh/Library/Application Support/Tunnelblick/Configurations/[XXXX]VPN.tblk

DEBUG 005: firstPath prefix DID match:

/Users/brandonh/Library/Application Support/Tunnelblick/Configurations/[XXXX]VPN.tblk

/Users/brandonh/Library/Application Support/Tunnelblick/Configurations

removed /Library/Application Support/Tunnelblick/Users/brandonh/[XXXX]VPN.tblk

2013-11-02 09:36:51 Tunnelblick[67333] Uninstalled configuration file /Users/brandonh/Library/Application Support/Tunnelblick/Configurations/[XXXX]VPN.tblk

2013-11-02 09:36:51 Tunnelblick[67333] Received fatal signal Trace/BPT trap (5). Stack trace: (

0 Tunnelblick 0x00011c4e signal_handler + 284

1 libsystem_platform.dylib 0x901bfdeb _sigtramp + 43

2 ??? 0xffffffff 0x0 + 4294967295

3 CoreFoundation 0x9494057c CFBasicHashFindBucket + 780

4 CoreFoundation 0x94940235 CFDictionaryGetValue + 101

5 CoreFoundation 0x94979fcc _copyValueForKey + 204

6 CoreFoundation 0x94979ede -[CFPrefsPlistSource copyValueForKey:] + 62

7 CoreFoundation 0x94979d83 -[CFPrefsSearchListSource alreadylocked_copyValueForKey:] + 163

8 CoreFoundation 0x94979cc2 -[CFPrefsSource copyValueForKey:] + 82

9 CoreFoundation 0x94979c5c __CFPreferencesCopyAppValue_block_invoke + 44

10 CoreFoundation 0x949733e2 +[CFPrefsSearchListSource withSearchListForIdentifier:perform:] + 978

11 CoreFoundation 0x94972fd6 CFPreferencesCopyAppValue + 166

12 Foundation 0x9ba5bb8a -[NSUserDefaults(NSUserDefaults) objectForKey:] + 34

13 Tunnelblick 0x0002b780 -[TBUserDefaults defaultsObjectForKey:] + 46

14 Tunnelblick 0x00045fcd -[MyPrefsWindowController setupPerConfigOpenvpnVersion:] + 97

15 Tunnelblick 0x00045008 -[MyPrefsWindowController setupLeftNavigationToDisplayName:] + 2170

16 Tunnelblick 0x00041eb5 -[MyPrefsWindowController update] + 34

17 Tunnelblick 0x0000e068 -[MenuController configFilesChanged] + 36

18 libobjc.A.dylib 0x946982af -[NSObject performSelector:withObject:] + 70

19 Foundation 0x9bab74d5 __NSThreadPerformPerform + 318

20 CoreFoundation 0x949bbe3f __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__ + 15

21 CoreFoundation 0x949acccb __CFRunLoopDoSources0 + 235

22 CoreFoundation 0x949ac3ce __CFRunLoopRun + 1022

23 CoreFoundation 0x949abd5a CFRunLoopRunSpecific + 394

24 CoreFoundation 0x949abbbb CFRunLoopRunInMode + 123

25 HIToolbox 0x96f9be2d RunCurrentEventLoopInMode + 259

26 HIToolbox 0x96f9bbb2 ReceiveNextEventCommon + 526

27 HIToolbox 0x96f9b98d _BlockUntilNextEventMatchingListInModeWithFilter + 92

28 AppKit 0x9a1fc5a9 _DPSNextEvent + 1602

29 AppKit 0x9a1fbad0 -[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] + 119

30 AppKit 0x9a1ee35c -[NSApplication run] + 727

31 AppKit 0x9a1d71f8 NSApplicationMain + 1165

32 Tunnelblick 0x00002049 _start + 208

33 Tunnelblick 0x00001f78 start + 40

)

jkbull...gmail.com

unread,

Nov 2, 2013, 1:31:50 PM11/2/13

to tunnelbli...@googlegroups.com, brandon...@gmail.com

On Saturday, November 2, 2013 1:04:24 PM UTC-4, Brandon Heller wrote:

Thanks for the fast, clear reply!

After removing and re-adding the ovpn file with the mtu line updated:
mtu-disc no

I got the same error printed in the console log. Given the help output for openvpn, I thought this would work.

But, if I delete the line entirely, I no longer get that error and can connect to the VPN.

That's what I would expect from my reading of the man page: it isn't that the option setting "yes" is not available, it is that the option itself is not available.

However, the VPN connection breaks my normal Internet connection, which is the next thing to fix :-)

That is often a DNS problem -- it depends on what you mean by "breaks".

To help diagnose that, put a check in "Check if the apparent public IP address changed after connection" checkbox, which you get to by selecting the configuration on the left side of the "VPN Details…" window, then clicking the "Advanced" button to get to the "Advanced" window. That should produce one of two errors: either DNS is not working, or the Internet in general is not reachable.

If it is a general Internet issue, you could try changing the "Route all traffic through the VPN" checkbox. It's on the "While Connected" tab of the "Advanced" window.

Also, I would like to report an unrelated bug. When deleting the sole tunnelblick VPN entry with the minus button, it produces this error:

"Tunnelblick encountered a fatal error.

Wow! That's definitely a problem. I'll look into it. Thanks for reporting it.

Brandon Heller

unread,

Nov 2, 2013, 3:20:41 PM11/2/13

to tunnelbli...@googlegroups.com, brandon...@gmail.com

All good now. There was a problem with DNS resolver configuration (fixed by admin) plus a variable-ping-delay performance issue (fixed by setting verb to 3 from 11 in the ovpn file).

Thanks!

jkbull...gmail.com

unread,

Nov 2, 2013, 4:10:59 PM11/2/13

to tunnelbli...@googlegroups.com, brandon...@gmail.com

I'm glad you have it working.

Thanks for reporting the crash. I have fixed the problem in the source code (the fix is included in r2561) and it will be in the next release.

Reply all

Reply to author

Forward