Verify socket ownership before treating a hypervisor PID as live

A bare liveness probe treats any process that reused a stored
hypervisor PID as the owning VMM. Require the PID to own the
instance's hypervisor socket on Linux before reporting it alive.

Author: yummybomb

lib/instances/process_identity_linux_test.go

@@ -0,0 +1,17 @@
+//go:build linux
+
+package instances
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestHypervisorProcessExistsRejectsLivePIDWithoutSocketOwnership(t *testing.T) {
+	t.Parallel()
+
+	assert.False(t, HypervisorProcessExists(os.Getpid(), filepath.Join(t.TempDir(), "missing.sock")))
+}

lib/instances/query.go

@@ -587,6 +587,21 @@ func refreshHypervisorPID(stored *StoredMetadata, state State) {
 	}
 }
 
+// HypervisorProcessExists reports whether pid owns the instance's hypervisor socket.
+func HypervisorProcessExists(pid int, socketPath string) bool {
+	if !ProcessExists(pid) {
+		return false
+	}
+	if runtime.GOOS != "linux" {
+		return true
+	}
+	if socketPath == "" {
+		return false
+	}
+	resolvedPID, err := hypervisor.ResolveProcessPID(socketPath)
+	return err == nil && resolvedPID == pid
+}
+
 // ProcessExists reports whether pid belongs to a live, non-zombie process.
 func ProcessExists(pid int) bool {
 	if pid <= 0 {