Commit Graph
7 Commits
Author SHA1 Message Date
milescovielloandClaude Opus 5.5 b9e987b82e fix(libkernel): refuse to pass a guest kqueue, a random device or a directory in SCM_RIGHTS
A guest kqueue and a guest /dev/urandom are /dev/null placeholders with
their behaviour in libkernel's tables, and a guest directory descriptor
keeps its reading state there too. sendmsg sent the placeholder, and the
receiver got a descriptor that failed kevent or read as empty. FreeBSD's
unp_internalize returns EOPNOTSUPP for a kqueue (no DFLAG_PASSABLE), so a
kqueue now gets that; a random device or a directory throws.

A zero-byte sendmsg carrying descriptors on a stream socket returned 0
and lost them, as Linux sends no record without data. It throws now.
FreeBSD sends the control data alone there.

guest_socket_rights checks the kqueue refusal and that the next send on
the pair arrives without control data.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
2026-10-29 04:21:45 +00:00
milescovielloandClaude Opus 5.5 1db8d77c9a fix(libkernel): own received descriptors until recvmsg has written its whole result
A fault on the final message header write, or an installation that fails
part-way, now closes every received descriptor exactly once. A plain-data
MSG_PEEK with control space on a Unix socket reads the data again, as on
main, and the test includes the public headers and counts host descriptors
portably.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
2026-10-27 23:03:09 +00:00
milescovielloandClaude Opus 5.5 484bc8c2c3 test(libkernel): expect recvmsg to return the close-on-exec flag in msg_flags
Since #10308, recvmsg starts msg_flags from the call's flags, as
measured on a PS5 and as FreeBSD's recvmsg does, so a receive with
MSG_CMSG_CLOEXEC reports it there. The two-socket case expected 0.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
2026-10-24 15:45:30 +00:00
milescovielloandClaude Opus 5.5 1142d3a6bc fix(libkernel): close passed descriptors when recvmsg faults writing the data or the address
Co-Authored-By: Claude Opus 5.5 <[email protected]>
2026-10-21 18:43:15 +00:00
milescovielloandClaude Opus 5.5 8b517b9e92 fix(libkernel): close the passed descriptors of an SCM_RIGHTS record that doesn't fit the control buffer
Co-Authored-By: Claude Opus 5.5 <[email protected]>
2026-10-21 18:43:15 +00:00
milescovielloandClaude Opus 5.5 9d2f3fb577 test(libkernel): check close-on-exec on a received host descriptor
The only MSG_CMSG_CLOEXEC case received sockets, whose F_GETFD reads the
guest's close-on-exec set, so it passed whether or not the received host
descriptor was marked. A pipe end goes through unchanged, so receiving
one with the flag now has to read back FD_CLOEXEC.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
2026-10-21 18:43:15 +00:00
milescovielloandClaude Opus 5.5 2f196610dd feat(libkernel): pass descriptors in SCM_RIGHTS messages on Unix sockets
sendmsg on a guest Unix-domain socket now takes FreeBSD SCM_RIGHTS control
messages (SOL_SOCKET level, data at offset 16) and sends their descriptors
with the host's SCM_RIGHTS; recvmsg receives them, installs received sockets
as guest sockets and writes FreeBSD's control record back, truncated to the
caller's buffer with MSG_CTRUNC. A closed descriptor returns EBADF, another
level or an overlong record EINVAL. Windows, other control types, IP
sockets and MSG_PEEK with a control buffer still throw.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
2026-10-21 18:43:14 +00:00