Harden hypervisor process liveness checks

lib/hypervisor/socket_pid.go

@@ -0,0 +1,5 @@
+package hypervisor
+
+import "errors"
+
+var ErrNoOwningProcess = errors.New("no owning process found")

lib/hypervisor/socket_pid_linux.go

@@ -4,70 +4,77 @@ package hypervisor
 
 import (
 	"bufio"
+	"errors"
 	"fmt"
+	"io/fs"
 	"os"
 	"path/filepath"
+	"slices"
 	"strconv"
 	"strings"
+	"syscall"
 )
 
+var procDir = "/proc"
+
+// soAcceptcon marks a listening socket in /proc/net/unix (__SO_ACCEPTCON).
+const soAcceptcon = 0x10000
+
 // ResolveProcessPID finds the process currently holding the listening Unix
-// socket for the given hypervisor control path.
-func ResolveProcessPID(socketPath string) (int, error) {
+// socket for the given hypervisor control path, via the socket inode in
+// /proc/net/unix and each process's fd table. The fd scan requires the
+// caller to hold CAP_SYS_PTRACE (or run as root) so no live owner is missed;
+// an ErrNoOwningProcess result is proof the listener is gone.
+func ResolveProcessPID(socketPath string) (pid int, err error) {
+	return resolveProcessPID(socketPath, 0)
+}
+
+// ResolveProcessPIDForOwner resolves a socket while preferring an expected
+// owner when the socket descriptor is temporarily shared with a child process.
+func ResolveProcessPIDForOwner(socketPath string, ownerPID int) (pid int, err error) {
+	return resolveProcessPID(socketPath, ownerPID)
+}
+
+func resolveProcessPID(socketPath string, ownerPID int) (pid int, err error) {
 	socketRef, err := socketRefForPath(socketPath)
-	if err == nil {
-		if pid, refErr := pidBySocketRef(socketRef); refErr == nil {
-			return pid, nil
-		}
+	if err != nil {
+		return 0, err
 	}
-
-	if pid, cmdErr := pidByCmdline(socketPath); cmdErr == nil {
-		return pid, nil
+	// Confirm the expected owner first so a live stored PID does not
+	// require scanning every process fd.
+	if ownerPID > 0 && processHoldsSocketRef(ownerPID, socketRef) {
+		return ownerPID, nil
 	}
-
-	return 0, fmt.Errorf("resolve process pid for socket %s: no owning process found", socketPath)
+	return pidBySocketRef(socketRef, ownerPID)
 }
 
-func pidBySocketRef(socketRef string) (int, error) {
-	procEntries, err := os.ReadDir("/proc")
+func processHoldsSocketRef(pid int, socketRef string) bool {
+	fdEntries, err := os.ReadDir(filepath.Join(procDir, strconv.Itoa(pid), "fd"))
 	if err != nil {
-		return 0, fmt.Errorf("read /proc: %w", err)
+		return false
 	}
-
-	for _, entry := range procEntries {
-		if !entry.IsDir() {
-			continue
-		}
-
-		pid, err := strconv.Atoi(entry.Name())
+	for _, fdEntry := range fdEntries {
+		target, err := os.Readlink(filepath.Join(procDir, strconv.Itoa(pid), "fd", fdEntry.Name()))
 		if err != nil {
+			// Skip fds that cannot be read, like the full scan does: an fd
+			// vanishing mid-scan must not hide a listener held by a later fd.
 			continue
 		}
-
-		fdEntries, err := os.ReadDir(filepath.Join("/proc", entry.Name(), "fd"))
-		if err != nil {
-			continue
-		}
-		for _, fdEntry := range fdEntries {
-			target, err := os.Readlink(filepath.Join("/proc", entry.Name(), "fd", fdEntry.Name()))
-			if err != nil {
-				continue
-			}
-			if strings.TrimSpace(target) == socketRef {
-				return pid, nil
-			}
+		if strings.TrimSpace(target) == socketRef {
+			return true
 		}
 	}
-
-	return 0, fmt.Errorf("resolve process pid for %s: no owning process found", socketRef)
+	return false
 }
 
-func pidByCmdline(socketPath string) (int, error) {
-	procEntries, err := os.ReadDir("/proc")
+func pidBySocketRef(socketRef string, ownerPID int) (int, error) {
+	procEntries, err := os.ReadDir(procDir)
 	if err != nil {
 		return 0, fmt.Errorf("read /proc: %w", err)
 	}
 
+	var owners []int
+	var scanErr error
 	for _, entry := range procEntries {
 		if !entry.IsDir() {
 			continue
@@ -78,28 +85,57 @@ func pidByCmdline(socketPath string) (int, error) {
 			continue
 		}
 
-		cmdline, err := os.ReadFile(filepath.Join("/proc", entry.Name(), "cmdline"))
-		if err != nil || len(cmdline) == 0 {
+		fdEntries, err := os.ReadDir(filepath.Join(procDir, entry.Name(), "fd"))
+		if err != nil {
+			if errors.Is(err, fs.ErrNotExist) || errors.Is(err, syscall.ESRCH) {
+				continue
+			}
+			scanErr = err
 			continue
 		}
-		for _, arg := range strings.Split(string(cmdline), "\x00") {
-			if arg == socketPath {
-				return pid, nil
+		for _, fdEntry := range fdEntries {
+			target, err := os.Readlink(filepath.Join(procDir, entry.Name(), "fd", fdEntry.Name()))
+			if err != nil {
+				if errors.Is(err, fs.ErrNotExist) || errors.Is(err, syscall.ESRCH) {
+					continue
+				}
+				scanErr = err
+				continue
+			}
+			if strings.TrimSpace(target) == socketRef {
+				owners = append(owners, pid)
+				break
 			}
 		}
 	}
 
-	return 0, fmt.Errorf("resolve process pid for socket %s: no matching command line found", socketPath)
+	// The scan observed ownerPID holding the listener fd — the same evidence
+	// the fast path uses — so a child transiently sharing the inherited fd
+	// must not turn a proven owner into an error.
+	if ownerPID > 0 && slices.Contains(owners, ownerPID) {
+		return ownerPID, nil
+	}
+	if len(owners) == 1 {
+		return owners[0], nil
+	}
+	if len(owners) > 1 {
+		return 0, fmt.Errorf("resolve process pid for %s: multiple owning processes found: %v", socketRef, owners)
+	}
+	if scanErr != nil {
+		return 0, fmt.Errorf("resolve process pid for %s: inspect process fds: %w", socketRef, scanErr)
+	}
+	return 0, fmt.Errorf("resolve process pid for %s: %w", socketRef, ErrNoOwningProcess)
 }
 
 func socketRefForPath(socketPath string) (string, error) {
-	file, err := os.Open("/proc/net/unix")
+	file, err := os.Open(filepath.Join(procDir, "net", "unix"))
 	if err != nil {
 		return "", fmt.Errorf("open /proc/net/unix: %w", err)
 	}
 	defer file.Close()
 
 	scanner := bufio.NewScanner(file)
+	var socketRef string
 	for scanner.Scan() {
 		fields := strings.Fields(scanner.Text())
 		if len(fields) < 7 {
@@ -112,14 +148,26 @@ func socketRefForPath(socketPath string) (string, error) {
 		if path != socketPath {
 			continue
 		}
+		// Accepted server-side sockets list the bound path too; only the
+		// listener identifies the owning process.
+		flags, parseErr := strconv.ParseUint(fields[3], 16, 32)
+		if parseErr != nil || flags&soAcceptcon == 0 {
+			continue
+		}
 		inode := fields[6]
 		if inode == "" {
 			break
 		}
-		return fmt.Sprintf("socket:[%s]", inode), nil
+		if socketRef != "" {
+			return "", fmt.Errorf("resolve process pid for socket %s: multiple socket inodes found", socketPath)
+		}
+		socketRef = fmt.Sprintf("socket:[%s]", inode)
 	}
 	if err := scanner.Err(); err != nil {
 		return "", fmt.Errorf("scan /proc/net/unix: %w", err)
 	}
-	return "", fmt.Errorf("resolve process pid for socket %s: socket inode not found", socketPath)
+	if socketRef != "" {
+		return socketRef, nil
+	}
+	return "", fmt.Errorf("resolve process pid for socket %s: socket inode not found: %w", socketPath, ErrNoOwningProcess)
 }