Harden hypervisor process liveness checks

lib/hypervisor/socket_pid.go

@@ -0,0 +1,5 @@
+package hypervisor
+
+import "errors"
+
+var ErrNoOwningProcess = errors.New("no owning process found")

lib/hypervisor/socket_pid_linux.go

@@ -4,70 +4,77 @@ package hypervisor
 
 import (
 	"bufio"
+	"errors"
 	"fmt"
+	"io/fs"
 	"os"
 	"path/filepath"
+	"slices"
 	"strconv"
 	"strings"
+	"syscall"
 )
 
+var procDir = "/proc"
+
+// soAcceptcon marks a listening socket in /proc/net/unix (__SO_ACCEPTCON).
+const soAcceptcon = 0x10000
+
 // ResolveProcessPID finds the process currently holding the listening Unix
-// socket for the given hypervisor control path.
-func ResolveProcessPID(socketPath string) (int, error) {
+// socket for the given hypervisor control path, via the socket inode in
+// /proc/net/unix and each process's fd table. The fd scan requires the
+// caller to hold CAP_SYS_PTRACE (or run as root) so no live owner is missed;
+// an ErrNoOwningProcess result is proof the listener is gone.
+func ResolveProcessPID(socketPath string) (pid int, err error) {
+	return resolveProcessPID(socketPath, 0)
+}
+
+// ResolveProcessPIDForOwner resolves a socket while preferring an expected
+// owner when the socket descriptor is temporarily shared with a child process.
+func ResolveProcessPIDForOwner(socketPath string, ownerPID int) (pid int, err error) {
+	return resolveProcessPID(socketPath, ownerPID)
+}
+
+func resolveProcessPID(socketPath string, ownerPID int) (pid int, err error) {
 	socketRef, err := socketRefForPath(socketPath)
-	if err == nil {
- if pid, refErr := pidBySocketRef(socketRef); refErr == nil {
- return pid, nil
- }
+	if err != nil {
+ return 0, err
 	}
-
-	if pid, cmdErr := pidByCmdline(socketPath); cmdErr == nil {
- return pid, nil
+	// Confirm the expected owner first so a live stored PID does not
+	// require scanning every process fd.
+	if ownerPID > 0 && processHoldsSocketRef(ownerPID, socketRef) {
+ return ownerPID, nil
 	}
-
-	return 0, fmt.Errorf("resolve process pid for socket %s: no owning process found", socketPath)
+	return pidBySocketRef(socketRef, ownerPID)
 }
 
-func pidBySocketRef(socketRef string) (int, error) {
-procEntries, err := os.ReadDir("/proc")
+func processHoldsSocketRef(pid int, socketRef string) bool {
+fdEntries, err := os.ReadDir(filepath.Join(procDir, strconv.Itoa(pid), "fd"))
 	if err != nil {
- return 0, fmt.Errorf("read /proc: %w", err)
+ return false
 	}
-
-	for _, entry := range procEntries {
- if !entry.IsDir() {
- continue
- }
-
- pid, err := strconv.Atoi(entry.Name())
+	for _, fdEntry := range fdEntries {
+ target, err := os.Readlink(filepath.Join(procDir, strconv.Itoa(pid), "fd", fdEntry.Name()))
  if err != nil {
+ // Skip fds that cannot be read, like the full scan does: an fd
+ // vanishing mid-scan must not hide a listener held by a later fd.
  continue
  }
-
- fdEntries, err := os.ReadDir(filepath.Join("/proc", entry.Name(), "fd"))
- if err != nil {
- continue
- }
- for _, fdEntry := range fdEntries {
- target, err := os.Readlink(filepath.Join("/proc", entry.Name(), "fd", fdEntry.Name()))
- if err != nil {
- continue
- }
- if strings.TrimSpace(target) == socketRef {
- return pid, nil
- }
+ if strings.TrimSpace(target) == socketRef {
+ return true
  }
 	}
-
-	return 0, fmt.Errorf("resolve process pid for %s: no owning process found", socketRef)
+	return false
 }
 
-func pidByCmdline(socketPath string) (int, error) {
-	procEntries, err := os.ReadDir("/proc")
+func pidBySocketRef(socketRef string, ownerPID int) (int, error) {
+	procEntries, err := os.ReadDir(procDir)
 	if err != nil {
  return 0, fmt.Errorf("read /proc: %w", err)
 	}
 
+	var owners []int
+	var scanErr error
 	for _, entry := range procEntries {
  if !entry.IsDir() {
  continue
@@ -78,28 +85,57 @@ func pidByCmdline(socketPath string) (int, error) {
  continue
  }
 
- cmdline, err := os.ReadFile(filepath.Join("/proc", entry.Name(), "cmdline"))
- if err != nil || len(cmdline) == 0 {
+ fdEntries, err := os.ReadDir(filepath.Join(procDir, entry.Name(), "fd"))
+ if err != nil {
+ if errors.Is(err, fs.ErrNotExist) || errors.Is(err, syscall.ESRCH) {
+ continue
+ }
+ scanErr = err
  continue
  }
- for _, arg := range strings.Split(string(cmdline), "\x00") {
- if arg == socketPath {
- return pid, nil
+ for _, fdEntry := range fdEntries {
+ target, err := os.Readlink(filepath.Join(procDir, entry.Name(), "fd", fdEntry.Name()))
+ if err != nil {
+ if errors.Is(err, fs.ErrNotExist) || errors.Is(err, syscall.ESRCH) {
+ continue
+ }
+ scanErr = err
+ continue
+ }
+ if strings.TrimSpace(target) == socketRef {
+ owners = append(owners, pid)
+ break
  }
  }
 	}
 
-	return 0, fmt.Errorf("resolve process pid for socket %s: no matching command line found", socketPath)
+	// The scan observed ownerPID holding the listener fd — the same evidence
+	// the fast path uses — so a child transiently sharing the inherited fd
+	// must not turn a proven owner into an error.
+	if ownerPID > 0 && slices.Contains(owners, ownerPID) {
+ return ownerPID, nil
+	}
+	if len(owners) == 1 {
+ return owners[0], nil
+	}
+	if len(owners) > 1 {
+ return 0, fmt.Errorf("resolve process pid for %s: multiple owning processes found: %v", socketRef, owners)
+	}
+	if scanErr != nil {
+ return 0, fmt.Errorf("resolve process pid for %s: inspect process fds: %w", socketRef, scanErr)
+	}
+	return 0, fmt.Errorf("resolve process pid for %s: %w", socketRef, ErrNoOwningProcess)
 }
 
 func socketRefForPath(socketPath string) (string, error) {
-	file, err := os.Open("/proc/net/unix")
+	file, err := os.Open(filepath.Join(procDir, "net", "unix"))
 	if err != nil {
  return "", fmt.Errorf("open /proc/net/unix: %w", err)
 	}
 	defer file.Close()
 
 	scanner := bufio.NewScanner(file)
+	var socketRef string
 	for scanner.Scan() {
  fields := strings.Fields(scanner.Text())
  if len(fields) < 7 {
@@ -112,14 +148,26 @@ func socketRefForPath(socketPath string) (string, error) {
  if path != socketPath {
  continue
  }
+ // Accepted server-side sockets list the bound path too; only the
+ // listener identifies the owning process.
+ flags, parseErr := strconv.ParseUint(fields[3], 16, 32)
+ if parseErr != nil || flags&soAcceptcon == 0 {
+ continue
+ }
  inode := fields[6]
  if inode == "" {
  break
  }
- return fmt.Sprintf("socket:[%s]", inode), nil
+ if socketRef != "" {
+ return "", fmt.Errorf("resolve process pid for socket %s: multiple socket inodes found", socketPath)
+ }
+ socketRef = fmt.Sprintf("socket:[%s]", inode)
 	}
 	if err := scanner.Err(); err != nil {
  return "", fmt.Errorf("scan /proc/net/unix: %w", err)
 	}
-	return "", fmt.Errorf("resolve process pid for socket %s: socket inode not found", socketPath)
+	if socketRef != "" {
+ return socketRef, nil
+	}
+	return "", fmt.Errorf("resolve process pid for socket %s: socket inode not found: %w", socketPath, ErrNoOwningProcess)
 }