Harden hypervisor process liveness checks

[yummybomb]

Summary

Layer 1 of the vendor VFIO vGPU stack (generalize-vgpu-device ← this ← vendor-vfio-backend ← vendor-vfio-vgpu). Pure hypervisor-process hardening with no vGPU-specific code; reviewable in isolation.

The upper layers guard vGPU release decisions on "is this instance's hypervisor still alive", so the liveness answer has to be trustworthy first:

• Unify liveness checks on ProcessExists — one exported, EPERM-aware, zombie-filtering definition instead of scattered bare kill(pid, 0) probes. EPERM means the process exists but cannot be signaled; treating it as dead would be wrong.
• Wait for non-child hypervisor exit before finishing kill — after a hypeman restart the hypervisor is not our child, so Wait4 returns ECHILD immediately and the kill loop finished before the process had exited. Poll for actual exit in that case.
• Verify process identity before teardown — a bare PID probe treats any process that reused a stored hypervisor PID as the owning VMM. On Linux, require confirmed socket ownership or a matching PID/start-time token scoped to the current host boot, including the graceful stop/delete wait path.

Testing

• go build ./..., go vet clean
• go test -race ./lib/instances/ targeted suites pass (TestCreateInstanceWithNetwork requires image pulls + iptables and fails in this environment on the unmodified base as well)

---

Note

High Risk
Changes fail-closed kill/delete/stop and Linux /proc socket resolution; mistakes could leave VMs running or SIGKILL the wrong process, and delete now errors instead of best-effort teardown when kill cannot be confirmed.

Overview
Hardens how hypeman decides which process owns a VM’s control socket and when it is safe to SIGKILL or tear down instance resources.

Linux socket PID resolution now returns (pid, confirmed, err), distinguishes confirmed FD ownership from cmdline-only matches, filters /proc/net/unix to listening sockets (__SO_ACCEPTCON), handles multiple owners via ResolveProcessPIDForOwner, and surfaces ErrNoOwningProcess.

Process identity is persisted as HypervisorStartTime and HypervisorBootID alongside HypervisorPID. resolveLiveHypervisorPID, HypervisorProcessExists, and exported ProcessExists (EPERM-aware, zombie-filtering) gate stop, delete, and PID refresh so reused PIDs or cmdline-only matches cannot satisfy destructive paths.

Delete/stop behavior is fail-closed: failed hypervisor kill aborts delete (metadata retained); killHypervisor and graceful shutdown wait on the confirmed socket owner and poll up to 30s after SIGKILL via improved WaitForProcessExit for non-child VMMs.

Identity fields are cleared on stop/standby/fork/snapshot rollback paths; broad Linux integration tests cover PID reuse, stale metadata, and unconfirmed ownership.

^{Reviewed by Cursor Bugbot for commit 2c2bb69. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 2c2bb69. Configure here.}

[cursor]

Unconfirmed PID becomes trusted identity

Medium Severity

resolveRuntimeHypervisorPID ignores the new confirmed flag from ResolveProcessPID, so a command-line-only match can be passed to setHypervisorProcessIdentity. Later, resolveLiveHypervisorPID short-circuits on that PID/start-time/boot-id token without checking socket ownership, which can target the wrong process on stop/delete while the real socket owner keeps running.

Additional Locations (2)

• lib/instances/query.go#L602-L606
• lib/instances/create.go#L790-L794

 

^{Reviewed by Cursor Bugbot for commit 2c2bb69. Configure here.}