Harden hypervisor process liveness checks

[yummybomb]

Summary

Layer 1 of the vendor VFIO vGPU stack (generalize-vgpu-device ← this ← vendor-vfio-backend ← vendor-vfio-vgpu). Pure hypervisor-process hardening with no vGPU-specific code; reviewable in isolation.

The upper layers guard vGPU release decisions on "is this instance's hypervisor still alive", so the liveness answer has to be trustworthy first:

• Unify liveness checks on ProcessExists — one exported, EPERM-aware, zombie-filtering definition instead of scattered bare kill(pid, 0) probes. EPERM means the process exists but cannot be signaled; treating it as dead would be wrong.
• Wait for non-child hypervisor exit before finishing kill — after a hypeman restart the hypervisor is not our child, so Wait4 returns ECHILD immediately and the kill loop finished before the process had exited. Poll for actual exit in that case.
• HypervisorProcessExists: verify socket ownership — a bare PID probe treats any process that reused a stored hypervisor PID as the owning VMM. On Linux, require the PID to own the instance's hypervisor socket before reporting it alive.

Testing

• go build ./..., go vet clean
• go test -race ./lib/instances/ targeted suites pass (TestCreateInstanceWithNetwork requires image pulls + iptables and fails in this environment on the unmodified base as well)

---

Note

Medium Risk
Changes delete-time SIGKILL targeting and hypervisor liveness signals; the design favors skipping kills over killing unrelated processes, but mis-resolved socket ownership could still leave a leaked VMM or kill the wrong owner in edge cases.

Overview
Hardens how hypeman decides whether a hypervisor is still alive and which PID to tear down on delete, so stale metadata after a restart cannot point SIGKILL at the wrong process.

Linux ResolveProcessPID now returns a confirmed flag when the PID comes from socket inode / FD ownership (vs cmdline fallback). Socket lookup in /proc/net/unix only treats __SO_ACCEPTCON listeners as the owner, ignores accepted connections that share the path, errors on ambiguous duplicate listeners, and surfaces FD scan failures instead of silently falling through.

Instance layer: unexported processExists becomes exported ProcessExists (EPERM-aware, zombie filtering on Linux). New HypervisorProcessExists requires the stored PID to own the instance control socket when ownership can be confirmed. killHypervisor only kills when ownership is confirmed (or on non-Linux / no socket path); on a confirmed mismatch it kills the socket owner; when ownership is unknown it skips the kill. The post-SIGKILL wait loop keeps polling until the process is gone when Wait4 returns ECHILD (hypervisor not a child after hypeman restart).

Integration tests cover reused PIDs, missing sockets, and socket rebound scenarios.

^{Reviewed by Cursor Bugbot for commit f8fbe79. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit f8fbe79. Configure here.}

[cursor]

Socket unlinked after skipped kill

High Severity

When socket ownership cannot be confirmed or an unconfirmed PID mismatch skips the kill, killHypervisor still calls os.Remove on SocketPath. That unlinks a live VMM’s control socket after the new logic deliberately refused to kill it, turning an intended recoverable leak into an unmanageable orphan.

 

^{Reviewed by Cursor Bugbot for commit f8fbe79. Configure here.}