I have isolated a severe file descriptor resource leak in ConnMan (connmand) that affects both LibreELEC 12 (RPi4/RPi5) and LibreELEC 13 (Generic/x86_64). When an addon or binary initializes an unmanaged, kernel-space WireGuard tunnel (wg0) directly via kernel interfaces, ConnMan's rtnl (Route Netlink) subsystem monitors the link changes but fails to release its internal tracking sockets. The file descriptors tick up steadily at about 5 FDs every 2 minutes until they hit the Linux operating system kernel ceiling of 1024 total FDs.
Once it reaches 1025 FDs, ConnMan throws a Too many open files error and crashes completely. Because LibreELEC depends entirely on ConnMan for networking, this crash drops all system IP routes, instantly dropping active SSH sessions and killing local network connectivity until a hard physical power cycle is performed. Conman Problem
Steps to Reproduce
- Manually initialize or cycle a standard kernel-space WireGuard interface (wg0) outside of ConnMan's limited D-Bus infrastructure.
- Track the file descriptor handle counts of the daemon over SSH:
watch -n 1 "ls -l /proc/\$(pidof connmand)/fd | wc -l"
Watch the baseline count steadily climb past 500, hitting the 1025 wall within 2–3 hours, resulting in a total network drop.
LibreELEC 12.2.1 (Pi5 system hitting the 1024 ceiling and dropping connection):
2026-07-19 17:56:00.000 info <general>: service.connman.monitor v1.0.0: Connman profile -> Sockets: 1015 | Total FDs: 1025 | VPND FDs: 10
2026-07-19 17:57:00.000 info <general>: service.connman.monitor v1.0.0: Connman profile -> Sockets: 1015 | Total FDs: 1025 | VPND FDs: 10
client_loop: send disconnect: Connection reset
ssh: connect to host 192.168.178.45 port 22: Connection timed out
LibreELEC 13 (Generic Test confirming the exact same leak profile remains active upstream):
2026-07-20 01:56:14.938 T:1313 info <general>: service.wireguard.manager v1.5.0~beta: Wm Utils: Connman socket leak detected (514/526 FDs). VPN is disconnected. Executing safe background network reclamation...
System Details:
- LibreELEC Versions Tested: 12.2.1 / LibreELEC-Generic.x86_64-13.0-nightly-20260719-3d3de99
- Hardware Tested: Raspberry Pi 4, Raspberry Pi 5, Generic x86_64.
- Workaround: I have had to write an addon script that intercepts the leak when the VPN is disconnected and safely calls an atomic background systemctl restart connman script loop to prevent hard crashes.
Has anyone else encountered this socket aggregation issue with custom virtual interfaces, or is there an upstream ConnMan patch planned to improve netlink garbage collection?
#!/bin/sh
<<'COMMENT'
chmod +x /storage/.config/scripts/service.connman.monitor.sh
crontab -e
* * * * * /storage/.config/scripts/service.connman.monitor.sh
tail -f /storage/.kodi/temp/kodi.log | grep -iE "service.connman.monitor"
COMMENT
LOG_FILE="/storage/.kodi/temp/kodi.log"
TAG="service.connman.monitor"
VERSION="v1.0.0"
PID_CONNMAN=$(pidof connmand)
PID_VPND=$(pidof connman-vpnd)
if [ -z "$PID_CONNMAN" ]; then
TIMESTAMP=$(date "+%Y-%m-%d %H:%M:%S.000")
echo "${TIMESTAMP} error <general>: ${TAG} ${VERSION}: Internal exception during connmand socket monitoring: connmand is not running!" >> "$LOG_FILE"
exit 1
fi
FD_TOTAL=$(ls -l /proc/"$PID_CONNMAN"/fd 2>/dev/null | wc -l)
FD_SOCKETS=$(ls -l /proc/"$PID_CONNMAN"/fd 2>/dev/null | grep -c "socket:")
if [ -n "$PID_VPND" ]; then
FD_VPND=$(ls -l /proc/"$PID_VPND"/fd 2>/dev/null | wc -l)
else
FD_VPND="0"
fi
TIMESTAMP=$(date "+%Y-%m-%d %H:%M:%S.000")
echo "${TIMESTAMP} info <general>: ${TAG} ${VERSION}: Connman profile -> Sockets: ${FD_SOCKETS} | Total FDs: ${FD_TOTAL} | VPND FDs: ${FD_VPND}" >> "$LOG_FILE"
Display More
2026-07-19 23:41:20.626 T:213859 info <general>: service.wireguard.manager v1.5.0~beta: Service Launcher: Hardware timings loaded for Raspberry Pi 5
2026-07-19 23:41:20.632 T:213859 info <general>: service.wireguard.manager v1.5.0~beta: Service Launcher: Monitor Service Initialized & Ready
2026-07-20 01:46:06.397 T:213859 info <general>: service.wireguard.manager v1.5.0~beta: Wm Utils: Connman socket leak detected (502/514 FDs). VPN disconnected. Executing safe background network reclamation...
https://paste.libreelec.tv/olivary-leonard.log
2026-07-20 02:06:56.078 T:756983 info <general>: service.wireguard.manager v1.5.0~beta: Service Launcher: Hardware timings loaded for Raspberry Pi 4
2026-07-20 02:06:56.090 T:756983 info <general>: service.wireguard.manager v1.5.0~beta: Service Launcher: Monitor Service Initialized & Ready
https://paste.libreelec.tv/mistiest-yung.log
LibreELEC-Generic-13
https://paste.libreelec.tv/englacial-brynlee.log
https://paste.libreelec.tv/antiempirical-samuel.log
Following up on my previous report regarding the severe file descriptor leak in connmand when using WireGuard (wg0) tunnels, my team and testers have successfully isolated the root causes and implemented a elegant solution, zero-leak workaround. It turns out there were two separate upstream tracking bugs inside ConnMan's older network cache layer that trigger when an out-of-band virtual interface alters default routing metrics.
