Remove the command-line fallback from socket owner resolution

A process matching the socket path by command line only can never
authorize teardown, so the fallback's sole effect was distinguishing
provable death from ambiguity. The fd scan runs with CAP_SYS_PTRACE
(hypeman runs as root or with full caps), so it cannot miss a live
owner and a missing listener already proves the hypervisor is gone.
The fallback was also actively harmful: a debug client holding the
socket path in its argv (ch-remote, socat) resolved as an unconfirmed
live match and wedged stop/delete until it exited.

Resolution now trusts the listener scan alone: a confirmed owner is
returned, no owner classifies as provable death, and only a failed
scan fails closed.

Author: yummybomb

lib/hypervisor/socket_pid_linux.go

@@ -20,43 +20,31 @@ var procDir = "/proc"
 const soAcceptcon = 0x10000
 
 // ResolveProcessPID finds the process currently holding the listening Unix
-// socket for the given hypervisor control path. confirmed reports whether the
-// PID was found through socket ownership rather than its command line.
-func ResolveProcessPID(socketPath string) (pid int, confirmed bool, err error) {
+// socket for the given hypervisor control path, via the socket inode in
+// /proc/net/unix and each process's fd table. The fd scan requires the
+// caller to hold CAP_SYS_PTRACE (or run as root) so no live owner is missed;
+// an ErrNoOwningProcess result is proof the listener is gone.
+func ResolveProcessPID(socketPath string) (pid int, err error) {
 	return resolveProcessPID(socketPath, 0)
 }
 
 // ResolveProcessPIDForOwner resolves a socket while preferring an expected
 // owner when the socket descriptor is temporarily shared with a child process.
-func ResolveProcessPIDForOwner(socketPath string, ownerPID int) (pid int, confirmed bool, err error) {
+func ResolveProcessPIDForOwner(socketPath string, ownerPID int) (pid int, err error) {
 	return resolveProcessPID(socketPath, ownerPID)
 }
 
-func resolveProcessPID(socketPath string, ownerPID int) (pid int, confirmed bool, err error) {
-	socketRef, socketErr := socketRefForPath(socketPath)
-	var refErr error
-	if socketErr == nil {
-		// Confirm the expected owner first so a live stored PID does not
-		// require scanning every process fd.
-		if ownerPID > 0 && processHoldsSocketRef(ownerPID, socketRef) {
-			return ownerPID, true, nil
-		}
-		pid, refErr = pidBySocketRef(socketRef, ownerPID)
-		if refErr == nil {
-			return pid, true, nil
-		}
-	}
-
-	if pid, cmdErr := pidByCmdline(socketPath); cmdErr == nil {
-		return pid, false, nil
-	}
-	if refErr != nil {
-		return 0, false, refErr
+func resolveProcessPID(socketPath string, ownerPID int) (pid int, err error) {
+	socketRef, err := socketRefForPath(socketPath)
+	if err != nil {
+		return 0, err
 	}
-	if socketErr != nil {
-		return 0, false, socketErr
+	// Confirm the expected owner first so a live stored PID does not
+	// require scanning every process fd.
+	if ownerPID > 0 && processHoldsSocketRef(ownerPID, socketRef) {
+		return ownerPID, nil
 	}
-	return 0, false, fmt.Errorf("resolve process pid for socket %s: %w", socketPath, ErrNoOwningProcess)
+	return pidBySocketRef(socketRef, ownerPID)
 }
 
 func processHoldsSocketRef(pid int, socketRef string) bool {
@@ -139,47 +127,6 @@ func pidBySocketRef(socketRef string, ownerPID int) (int, error) {
 	return 0, fmt.Errorf("resolve process pid for %s: %w", socketRef, ErrNoOwningProcess)
 }
 
-func pidByCmdline(socketPath string) (int, error) {
-	procEntries, err := os.ReadDir(procDir)
-	if err != nil {
-		return 0, fmt.Errorf("read /proc: %w", err)
-	}
-
-	var scanErr error
-	for _, entry := range procEntries {
-		if !entry.IsDir() {
-			continue
-		}
-
-		pid, err := strconv.Atoi(entry.Name())
-		if err != nil {
-			continue
-		}
-
-		cmdline, err := os.ReadFile(filepath.Join(procDir, entry.Name(), "cmdline"))
-		if err != nil {
-			if errors.Is(err, fs.ErrNotExist) || errors.Is(err, syscall.ESRCH) {
-				continue
-			}
-			scanErr = err
-			continue
-		}
-		if len(cmdline) == 0 {
-			continue
-		}
-		for _, arg := range strings.Split(string(cmdline), "\x00") {
-			if arg == socketPath {
-				return pid, nil
-			}
-		}
-	}
-
-	if scanErr != nil {
-		return 0, fmt.Errorf("resolve process pid for socket %s: inspect process command lines: %w", socketPath, scanErr)
-	}
-	return 0, fmt.Errorf("resolve process pid for socket %s: no matching command line found: %w", socketPath, ErrNoOwningProcess)
-}
-
 func socketRefForPath(socketPath string) (string, error) {
 	file, err := os.Open(filepath.Join(procDir, "net", "unix"))
 	if err != nil {

lib/hypervisor/socket_pid_linux_test.go

@@ -23,9 +23,8 @@ func TestResolveProcessPID(t *testing.T) {
 	require.NoError(t, err)
 	defer listener.Close()
 
-	pid, confirmed, err := ResolveProcessPID(socketPath)
+	pid, err := ResolveProcessPID(socketPath)
 	require.NoError(t, err)
-	require.True(t, confirmed)
 	require.Equal(t, os.Getpid(), pid)
 }
 
@@ -46,13 +45,12 @@ func TestResolveProcessPIDIgnoresConnectedSocketEntries(t *testing.T) {
 	require.NoError(t, err)
 	defer accepted.Close()
 
-	pid, confirmed, err := ResolveProcessPID(socketPath)
+	pid, err := ResolveProcessPID(socketPath)
 	require.NoError(t, err)
-	require.True(t, confirmed)
 	require.Equal(t, os.Getpid(), pid)
 }
 
-func TestResolveProcessPIDIsUnconfirmedForDuplicateSocketPaths(t *testing.T) {
+func TestResolveProcessPIDFailsForDuplicateSocketPaths(t *testing.T) {
 	oldProcDir := procDir
 	procDir = t.TempDir()
 	t.Cleanup(func() { procDir = oldProcDir })
@@ -63,9 +61,8 @@ func TestResolveProcessPIDIsUnconfirmedForDuplicateSocketPaths(t *testing.T) {
 		"00000000: 00000002 00000000 00010000 0001 01 12345 "+socketPath+"\n"+
 			"00000000: 00000002 00000000 00010000 0001 01 67890 "+socketPath+"\n"), 0o644))
 
-	_, confirmed, err := ResolveProcessPID(socketPath)
+	_, err := ResolveProcessPID(socketPath)
 	require.ErrorContains(t, err, "multiple socket inodes found")
-	require.False(t, confirmed)
 }
 
 func TestResolveProcessPIDToleratesExitedProcess(t *testing.T) {
@@ -81,9 +78,8 @@ func TestResolveProcessPIDToleratesExitedProcess(t *testing.T) {
 	require.NoError(t, os.MkdirAll(fdDir, 0o755))
 	require.NoError(t, os.Symlink("socket:[12345]", filepath.Join(fdDir, "3")))
 
-	pid, confirmed, err := ResolveProcessPID(socketPath)
+	pid, err := ResolveProcessPID(socketPath)
 	require.NoError(t, err)
-	require.True(t, confirmed)
 	require.Equal(t, 200, pid)
 }
 
@@ -101,13 +97,11 @@ func TestResolveProcessPIDForOwnerPrefersExpectedProcess(t *testing.T) {
 		require.NoError(t, os.Symlink("socket:[12345]", filepath.Join(fdDir, "3")))
 	}
 
-	_, confirmed, err := ResolveProcessPID(socketPath)
+	_, err := ResolveProcessPID(socketPath)
 	require.ErrorContains(t, err, "multiple owning processes found")
-	require.False(t, confirmed)
 
-	pid, confirmed, err := ResolveProcessPIDForOwner(socketPath, 101)
+	pid, err := ResolveProcessPIDForOwner(socketPath, 101)
 	require.NoError(t, err)
-	require.True(t, confirmed)
 	require.Equal(t, 101, pid)
 }
 
@@ -121,9 +115,8 @@ func TestResolveProcessPIDReportsNoOwnerAfterExitedProcesses(t *testing.T) {
 	require.NoError(t, os.WriteFile(filepath.Join(procDir, "net", "unix"), []byte("00000000: 00000002 00000000 00010000 0001 01 12345 "+socketPath+"\n"), 0o644))
 	require.NoError(t, os.MkdirAll(filepath.Join(procDir, "100"), 0o755))
 
-	_, confirmed, err := ResolveProcessPID(socketPath)
+	_, err := ResolveProcessPID(socketPath)
 	require.ErrorIs(t, err, ErrNoOwningProcess)
-	require.False(t, confirmed)
 	require.NotContains(t, err.Error(), "inspect process fds")
 }
 
@@ -135,9 +128,8 @@ func TestResolveProcessPIDReportsMissingSocket(t *testing.T) {
 	require.NoError(t, os.MkdirAll(filepath.Join(procDir, "net"), 0o755))
 	require.NoError(t, os.WriteFile(filepath.Join(procDir, "net", "unix"), nil, 0o644))
 
-	_, confirmed, err := ResolveProcessPID("/tmp/missing.sock")
+	_, err := ResolveProcessPID("/tmp/missing.sock")
 	require.ErrorIs(t, err, ErrNoOwningProcess)
-	require.False(t, confirmed)
 }
 
 func TestResolveProcessPIDFailsWhenFDIsUnreadable(t *testing.T) {
@@ -152,9 +144,8 @@ func TestResolveProcessPIDFailsWhenFDIsUnreadable(t *testing.T) {
 	require.NoError(t, os.MkdirAll(fdDir, 0o755))
 	require.NoError(t, os.WriteFile(filepath.Join(fdDir, "3"), nil, 0o644))
 
-	_, confirmed, err := ResolveProcessPID(socketPath)
+	_, err := ResolveProcessPID(socketPath)
 	require.Error(t, err)
-	require.False(t, confirmed)
 	require.ErrorContains(t, err, "inspect process fds")
 	require.False(t, errors.Is(err, ErrNoOwningProcess))
 }
@@ -177,9 +168,8 @@ func TestResolveProcessPIDForOwnerConfirmsCandidateWithoutFullScan(t *testing.T)
 	require.NoError(t, os.MkdirAll(siblingFDDir, 0o755))
 	require.NoError(t, os.WriteFile(filepath.Join(siblingFDDir, "3"), nil, 0o644))
 
-	pid, confirmed, err := ResolveProcessPIDForOwner(socketPath, 100)
+	pid, err := ResolveProcessPIDForOwner(socketPath, 100)
 	require.NoError(t, err)
-	require.True(t, confirmed)
 	require.Equal(t, 100, pid)
 }
 
@@ -199,9 +189,8 @@ func TestResolveProcessPIDForOwnerSkipsUnreadableCandidateFD(t *testing.T) {
 	require.NoError(t, os.WriteFile(filepath.Join(fdDir, "1"), nil, 0o644))
 	require.NoError(t, os.Symlink("socket:[12345]", filepath.Join(fdDir, "3")))
 
-	pid, confirmed, err := ResolveProcessPIDForOwner(socketPath, 100)
+	pid, err := ResolveProcessPIDForOwner(socketPath, 100)
 	require.NoError(t, err)
-	require.True(t, confirmed)
 	require.Equal(t, 100, pid)
 }
 
@@ -222,9 +211,8 @@ func TestResolveProcessPIDForOwnerFallsThroughWhenCandidateLacksSocket(t *testin
 	require.NoError(t, os.MkdirAll(ownerFDDir, 0o755))
 	require.NoError(t, os.Symlink("socket:[12345]", filepath.Join(ownerFDDir, "3")))
 
-	pid, confirmed, err := ResolveProcessPIDForOwner(socketPath, 999)
+	pid, err := ResolveProcessPIDForOwner(socketPath, 999)
 	require.NoError(t, err)
-	require.True(t, confirmed)
 	require.Equal(t, 200, pid)
 }
 
@@ -241,9 +229,8 @@ func TestResolveProcessPIDForOwnerFallsThroughWhenCandidateIsGone(t *testing.T)
 	require.NoError(t, os.MkdirAll(ownerFDDir, 0o755))
 	require.NoError(t, os.Symlink("socket:[12345]", filepath.Join(ownerFDDir, "3")))
 
-	pid, confirmed, err := ResolveProcessPIDForOwner(socketPath, 999)
+	pid, err := ResolveProcessPIDForOwner(socketPath, 999)
 	require.NoError(t, err)
-	require.True(t, confirmed)
 	require.Equal(t, 200, pid)
 }
 
@@ -255,9 +242,8 @@ func TestResolveProcessPIDForOwnerReportsMissingSocket(t *testing.T) {
 	require.NoError(t, os.MkdirAll(filepath.Join(procDir, "net"), 0o755))
 	require.NoError(t, os.WriteFile(filepath.Join(procDir, "net", "unix"), []byte("00000000: 00000002 00000000 00010000 0001 01 12345 /tmp/other.sock\n"), 0o644))
 
-	_, confirmed, err := ResolveProcessPIDForOwner("/tmp/missing.sock", 100)
+	_, err := ResolveProcessPIDForOwner("/tmp/missing.sock", 100)
 	require.ErrorIs(t, err, ErrNoOwningProcess)
-	require.False(t, confirmed)
 }
 
 func TestResolveProcessPIDForOwnerReportsMissingSocketWithHeaderOnlyUnixTable(t *testing.T) {
@@ -268,9 +254,8 @@ func TestResolveProcessPIDForOwnerReportsMissingSocketWithHeaderOnlyUnixTable(t
 	require.NoError(t, os.MkdirAll(filepath.Join(procDir, "net"), 0o755))
 	require.NoError(t, os.WriteFile(filepath.Join(procDir, "net", "unix"), []byte("Num       RefCount Protocol Flags    Type St Inode Path\n"), 0o644))
 
-	_, confirmed, err := ResolveProcessPIDForOwner("/tmp/missing.sock", 100)
+	_, err := ResolveProcessPIDForOwner("/tmp/missing.sock", 100)
 	require.ErrorIs(t, err, ErrNoOwningProcess)
-	require.False(t, confirmed)
 }
 
 func TestResolveProcessPIDForOwnerReportsDuplicateSocketInodes(t *testing.T) {
@@ -288,9 +273,8 @@ func TestResolveProcessPIDForOwnerReportsDuplicateSocketInodes(t *testing.T) {
 	require.NoError(t, os.MkdirAll(fdDir, 0o755))
 	require.NoError(t, os.Symlink("socket:[12345]", filepath.Join(fdDir, "3")))
 
-	_, confirmed, err := ResolveProcessPIDForOwner(socketPath, 100)
+	_, err := ResolveProcessPIDForOwner(socketPath, 100)
 	require.ErrorContains(t, err, "multiple socket inodes found")
-	require.False(t, confirmed)
 }
 
 func TestResolveProcessPIDForOwnerConfirmsLiveListener(t *testing.T) {
@@ -301,12 +285,29 @@ func TestResolveProcessPIDForOwnerConfirmsLiveListener(t *testing.T) {
 	require.NoError(t, err)
 	defer listener.Close()
 
-	pid, confirmed, err := ResolveProcessPIDForOwner(socketPath, os.Getpid())
+	pid, err := ResolveProcessPIDForOwner(socketPath, os.Getpid())
 	require.NoError(t, err)
-	require.True(t, confirmed)
 	require.Equal(t, os.Getpid(), pid)
 }
 
+func TestResolveProcessPIDIgnoresCommandLineBystander(t *testing.T) {
+	socketPath := filepath.Join(t.TempDir(), "test.sock")
+	require.NoError(t, os.WriteFile(socketPath, nil, 0o600))
+
+	// A process carrying the socket path in its command line (e.g. a debug
+	// client like ch-remote) without holding the listener must not resolve
+	// as the owner; a missing listener is proof the hypervisor is gone.
+	bystander := exec.Command("sh", "-c", "sleep 30", "sh", socketPath)
+	require.NoError(t, bystander.Start())
+	t.Cleanup(func() {
+		_ = bystander.Process.Kill()
+		_ = bystander.Wait()
+	})
+
+	_, err := ResolveProcessPID(socketPath)
+	require.ErrorIs(t, err, ErrNoOwningProcess)
+}
+
 func TestResolveProcessPIDDuringProcessChurn(t *testing.T) {
 	socketPath := filepath.Join(t.TempDir(), "test.sock")
 	listener, err := net.Listen("unix", socketPath)
@@ -328,9 +329,8 @@ func TestResolveProcessPIDDuringProcessChurn(t *testing.T) {
 
 	deadline := time.Now().Add(2 * time.Second)
 	for time.Now().Before(deadline) {
-		pid, confirmed, err := ResolveProcessPIDForOwner(socketPath, os.Getpid())
+		pid, err := ResolveProcessPIDForOwner(socketPath, os.Getpid())
 		require.NoError(t, err)
-		require.True(t, confirmed)
 		require.Equal(t, os.Getpid(), pid)
 	}
 }

lib/hypervisor/socket_pid_other.go

@@ -6,11 +6,11 @@ import "fmt"
 
 // ResolveProcessPID is only implemented on Linux, where the project relies on
 // /proc socket metadata for runtime PID discovery.
-func ResolveProcessPID(socketPath string) (int, bool, error) {
-	return 0, false, fmt.Errorf("resolve process pid for socket %s: not supported on this platform", socketPath)
+func ResolveProcessPID(socketPath string) (int, error) {
+	return 0, fmt.Errorf("resolve process pid for socket %s: not supported on this platform", socketPath)
 }
 
 // ResolveProcessPIDForOwner is only implemented on Linux.
-func ResolveProcessPIDForOwner(socketPath string, _ int) (int, bool, error) {
+func ResolveProcessPIDForOwner(socketPath string, _ int) (int, error) {
 	return ResolveProcessPID(socketPath)
 }

lib/instances/create.go

@@ -808,15 +808,13 @@ func (m *manager) startAndBootVM(
 // resolveRuntimeHypervisorPID resolves the runtime PID of the hypervisor
 // serving the instance socket and records its process identity. The
 // boot-scoped identity token is minted only for a trustworthy PID — the
-// direct child we spawned or the confirmed socket owner. A command-line-only
-// match records the bare PID without the token, so destructive paths must
-// confirm socket ownership before trusting it.
+// direct child we spawned or the confirmed socket owner.
 func resolveRuntimeHypervisorPID(log *slog.Logger, stored *StoredMetadata, fallbackPID int) int {
 	if ProcessExists(fallbackPID) {
 		stored.HypervisorProcessIdentity.Set(fallbackPID)
 		return fallbackPID
 	}
-	pid, confirmed, err := hypervisor.ResolveProcessPID(stored.SocketPath)
+	pid, err := hypervisor.ResolveProcessPID(stored.SocketPath)
 	if err != nil {
 		// The fallback PID was just proven dead, so it gets no identity
 		// token: minting one would stamp the current boot ID (and, if the
@@ -826,11 +824,7 @@ func resolveRuntimeHypervisorPID(log *slog.Logger, stored *StoredMetadata, fallb
 		stored.HypervisorProcessIdentity.SetUnconfirmed(fallbackPID)
 		return fallbackPID
 	}
-	if confirmed {
-		stored.HypervisorProcessIdentity.Set(pid)
-		return pid
-	}
-	stored.HypervisorProcessIdentity.SetUnconfirmed(pid)
+	stored.HypervisorProcessIdentity.Set(pid)
 	return pid
 }
 

lib/instances/guestmemory_linux_test.go

@@ -214,7 +214,7 @@ func requireHypervisorPID(t *testing.T, ctx context.Context, mgr *manager, insta
 	if inst.HypervisorPID != nil && ProcessExists(*inst.HypervisorPID) {
 		return *inst.HypervisorPID
 	}
-	if pid, _, err := hypervisor.ResolveProcessPID(inst.SocketPath); err == nil {
+	if pid, err := hypervisor.ResolveProcessPID(inst.SocketPath); err == nil {
 		return pid
 	}
 	require.NotNil(t, inst.HypervisorPID)

lib/instances/identity_backfill_linux_test.go

@@ -82,7 +82,7 @@ func TestBackfillHypervisorProcessIdentitiesSkipsMissingSocketOwner(t *testing.T
 	assert.NoError(t, syscall.Kill(stalePID, 0))
 }
 
-func TestBackfillHypervisorProcessIdentitiesSkipsUnconfirmedCommandLineMatch(t *testing.T) {
+func TestBackfillHypervisorProcessIdentitiesIgnoresCommandLineBystander(t *testing.T) {
 	mgr := &manager{paths: paths.New(t.TempDir())}
 	socketPath := filepath.Join(t.TempDir(), "test.sock")
 	match := exec.Command("sh", "-c", "sleep 30", "sh", socketPath)