Harden VNC server, IPC, and management plumbing

client/vnc/server/agent_peercred_darwin.go

@@ -0,0 +1,46 @@
+//go:build darwin && !ios
+
+package server
+
+import (
+	"fmt"
+	"net"
+
+	"golang.org/x/sys/unix"
+)
+
+// validateAgentPeer enforces that the peer behind the just-connected Unix
+// socket is the agent we expect it to be: a process running under
+// expectedUID, with the right effective uid stamped by the kernel on the
+// socket. Refuses (with a non-nil error) if anything else is listening on
+// the path (an unrelated local process that won the listen race or
+// squatted the path before us). Defends against the daemon shipping its
+// per-spawn auth token to a process that isn't the spawned agent.
+func validateAgentPeer(conn net.Conn, expectedUID uint32) error {
+	uconn, ok := conn.(*net.UnixConn)
+	if !ok {
+		return fmt.Errorf("peer cred: expected *net.UnixConn, got %T", conn)
+	}
+	raw, err := uconn.SyscallConn()
+	if err != nil {
+		return fmt.Errorf("peer cred: syscall conn: %w", err)
+	}
+	var cred *unix.Xucred
+	var inner error
+	ctlErr := raw.Control(func(fd uintptr) {
+		cred, inner = unix.GetsockoptXucred(int(fd), unix.SOL_LOCAL, unix.LOCAL_PEERCRED)
+	})
+	if ctlErr != nil {
+		return fmt.Errorf("peer cred: control: %w", ctlErr)
+	}
+	if inner != nil {
+		return fmt.Errorf("peer cred: getsockopt LOCAL_PEERCRED: %w", inner)
+	}
+	if cred == nil {
+		return fmt.Errorf("peer cred: nil xucred")
+	}
+	if cred.Uid != expectedUID {
+		return fmt.Errorf("peer cred: agent uid %d does not match expected %d", cred.Uid, expectedUID)
+	}
+	return nil
+}