Add safe daemon Unix socket listen

[mariusvniekerk]

Summary

• add daemon.Listen(ctx, ep, opts) for daemon server startup
• serialize Unix stale socket probing/removal and bind under an inter-process listen lock
• reject live Unix sockets and non-socket paths instead of removing them
• add RuntimeStore.ListenLockPath() so server listen locking stays separate from Manager.Ensure auto-start locking
• cover stale Unix socket cleanup, live/non-socket refusal, and concurrent startup behavior

Kata API

Kata daemon server startup should use:

listener, err := daemon.Listen(ctx, endpoint, daemon.ListenOptions{Store: runtimeStore})

If kata does not have a RuntimeStore in that startup path, pass a stable explicit LockPath or rely on the default lock derived from the Unix socket path.

Validation

• go test ./daemon
• go test ./...

[roborev-ci]

roborev: Combined Review (a349861)

Synthesis unavailable. Showing individual review outputs.

codex — default (done)

Review Findings

• Severity: Medium
• Location: daemon/lock.go:29
• Problem: Relative lock paths are treated as directories to harden, so LockPath: "daemon.lock" or a relative Unix endpoint that derives daemon.sock.lock makes ensurePrivateRuntimeDir(".") potentially chmod the process working directory to 0700.
• Fix: Reject relative lock paths for this helper, or normalize them to an intended private runtime directory before calling ensurePrivateRuntimeDir.

Summary

The change adds a locked Unix-socket listen helper with stale socket cleanup and refactors daemon start locking through the same lock helper.

---

codex — security (done)

No issues found.

[roborev-ci]

roborev: Fail

Medium-risk issues found; no Critical or High findings were reported.

Medium

• daemon/listen.go:61
  ListenOptions.Store.Dir can move the listen lock into the private store path while leaving the Unix socket itself in an unvalidated shared directory such as /tmp. This allows binding daemon API sockets in locations other local users may access.
  Fix: Always validate the Unix socket parent directory before stale probing/removal and bind, independent of Store or LockPath, or explicitly create/chmod the socket with restrictive permissions and reject shared/world-writable socket directories.

• daemon/listen.go:80
  Relative Unix socket paths are still accepted when the caller provides an absolute LockPath or Store, so stale cleanup and binding can happen relative to the process working directory, bypassing the absolute-path invariant enforced by ParseEndpoint.
  Fix: Reject non-absolute ep.Address for Unix endpoints before acquiring the lock or touching the filesystem.

• daemon/listen_unix.go:10
  The stale probe only treats ECONNREFUSED as stale. If an existing listener closes and unlinks the socket between Lstat and Dial, the dial can return ENOENT, causing startup to fail even though the path is now free.
  Fix: Treat os.ErrNotExist/syscall.ENOENT during the probe as a missing stale socket and proceed to bind, with removal skipped or ErrNotExist ignored.

---

Panel: ci_default_security | Synthesis: codex, 10s, ~$0.02 | Members: codex_default (codex/default, done, 5m24s, ~$0.69), codex_security (codex/security, done, 2m21s, ~$0.46) | Total: 7m55s, ~$1.18 | Job: 19549

[roborev-ci]

roborev: Fail

High-risk issue remains: the daemon can chmod arbitrary existing runtime parent directories before path validation.

High

• daemon/listen.go:68 and daemon/lock.go:32
  The new listen and lock paths use ensurePrivateRuntimeDir on arbitrary parent directories, and that helper chmods any directory owned by the current user to 0700. A daemon running as root with a socket or lock under /tmp, /run, or /var/run can silently change system/shared directory permissions instead of rejecting the path.
  Fix: Use non-mutating validation for existing socket/lock parent directories, or only create/chmod a dedicated leaf directory owned by this code; reject existing shared/system directories that are not already private.

Medium

• daemon/runtime.go:119
  Store-derived listen lock paths still call s.prepareDir() before the later absolute-path check in acquireDaemonLock, so ListenOptions{Store: RuntimeStore{Dir: "."}} can harden/chmod the current working directory before failing because the lock path is relative.
  Fix: Reject or canonicalize relative RuntimeStore.Dir before calling prepareDir() in lock-path helpers, and add coverage for store-derived relative lock paths.

---

Panel: ci_default_security | Synthesis: codex, 18s | Members: codex_default (codex/default, done, 4m51s), codex_security (codex/security, done, 24s) | Total: 5m33s | Job: 19552

[roborev-ci]

roborev: Combined Review (25b6fd9)

No issues found.

---

Synthesized from 2 reviews (agents: codex | types: default, security)

---

Panel: ci_default_security | Synthesis: codex | Members: codex_default (codex/default, done, 2m51s), codex_security (codex/security, done, 2m41s) | Total: 5m32s | Job: 19579