Harden systemd listener adoption

eldryoth · eldryoth · commit e9ba4413f934 · 2026-07-15T15:03:39.000+02:00
diff --git a/crates/fluxheim-systemd/examples/activation_ownership_probe.rs b/crates/fluxheim-systemd/examples/activation_ownership_probe.rs
@@ -6,9 +6,10 @@ fn main() -> io::Result<()> {
         Some("concurrent") => concurrent_claim_probe(),
         Some("repeat") => repeat_claim_probe(),
         Some("failed-validation-retry") => failed_validation_retry_probe(),
+        Some("oversized-declaration") => oversized_declaration_probe(),
         _ => Err(io::Error::new(
             io::ErrorKind::InvalidInput,
-            "expected concurrent, repeat, or failed-validation-retry probe",
+            "expected concurrent, repeat, failed-validation-retry, or oversized-declaration probe",
         )),
     }
 }
@@ -110,6 +111,20 @@ fn failed_validation_retry_probe() -> io::Result<()> {
     Ok(())
 }
 
+#[cfg(target_os = "linux")]
+fn oversized_declaration_probe() -> io::Result<()> {
+    let error = match fluxheim_systemd::receive_tcp_listeners(1) {
+        Ok(_) => return Err(io::Error::other("oversized LISTEN_FDS was accepted")),
+        Err(error) => error,
+    };
+    if error.kind() != io::ErrorKind::InvalidInput
+        || !error.to_string().contains("LISTEN_FDS declares 129")
+    {
+        return Err(error);
+    }
+    Ok(())
+}
+
 #[cfg(not(target_os = "linux"))]
 fn main() -> io::Result<()> {
     Err(io::Error::new(
diff --git a/crates/fluxheim-systemd/src/lib.rs b/crates/fluxheim-systemd/src/lib.rs
@@ -10,6 +10,9 @@ use std::sync::atomic::{AtomicBool, Ordering};
 #[cfg(target_os = "linux")]
 static ACTIVATION_CONSUMED: AtomicBool = AtomicBool::new(false);
 
+#[cfg(target_os = "linux")]
+const MAX_ACTIVATION_LISTENERS: usize = 128;
+
 #[cfg(target_os = "linux")]
 pub fn receive_tcp_listeners(expected: usize) -> io::Result<Vec<TcpListener>> {
     use std::os::fd::{FromRawFd as _, IntoRawFd as _, OwnedFd};
@@ -25,6 +28,8 @@ pub fn receive_tcp_listeners(expected: usize) -> io::Result<Vec<TcpListener>> {
             )
         })?;
 
+    validate_declared_count(expected, activation_listener_declaration()?.as_deref())?;
+
     // `false` is security-critical: environment mutation is unsound once other
     // process threads can concurrently read libc's environment storage.
     let descriptors =
@@ -71,19 +76,83 @@ pub fn receive_tcp_listeners(expected: usize) -> io::Result<Vec<TcpListener>> {
 
 #[cfg(target_os = "linux")]
 fn validated_tcp_listener(index: usize, owned: std::os::fd::OwnedFd) -> io::Result<TcpListener> {
-    if rustix::net::sockopt::socket_type(&owned)? != rustix::net::SocketType::STREAM {
+    validate_tcp_listener_properties(
+        index,
+        rustix::net::sockopt::socket_type(&owned)?,
+        rustix::net::sockopt::socket_protocol(&owned)?,
+        rustix::net::sockopt::socket_acceptconn(&owned)?,
+    )?;
+    Ok(TcpListener::from(owned))
+}
+
+#[cfg(target_os = "linux")]
+fn validate_tcp_listener_properties(
+    index: usize,
+    socket_type: rustix::net::SocketType,
+    protocol: Option<rustix::net::Protocol>,
+    listening: bool,
+) -> io::Result<()> {
+    if socket_type != rustix::net::SocketType::STREAM {
+        return Err(io::Error::new(
+            io::ErrorKind::InvalidInput,
+            format!("descriptor index {index} is not a stream socket"),
+        ));
+    }
+    if protocol != Some(rustix::net::ipproto::TCP) {
         return Err(io::Error::new(
             io::ErrorKind::InvalidInput,
-            format!("descriptor index {index} is not a TCP stream socket"),
+            format!("descriptor index {index} does not use TCP"),
         ));
     }
-    if !rustix::net::sockopt::socket_acceptconn(&owned)? {
+    if !listening {
         return Err(io::Error::new(
             io::ErrorKind::InvalidInput,
             format!("descriptor index {index} is not in listening state"),
         ));
     }
-    Ok(TcpListener::from(owned))
+    Ok(())
+}
+
+#[cfg(target_os = "linux")]
+fn activation_listener_declaration() -> io::Result<Option<String>> {
+    std::env::var_os("LISTEN_FDS")
+        .map(|value| {
+            value.into_string().map_err(|_| {
+                io::Error::new(
+                    io::ErrorKind::InvalidInput,
+                    "LISTEN_FDS is not valid Unicode",
+                )
+            })
+        })
+        .transpose()
+}
+
+#[cfg(target_os = "linux")]
+fn validate_declared_count(expected: usize, declared: Option<&str>) -> io::Result<()> {
+    if !(1..=MAX_ACTIVATION_LISTENERS).contains(&expected) {
+        return Err(io::Error::new(
+            io::ErrorKind::InvalidInput,
+            "expected listener count must be between 1 and 128",
+        ));
+    }
+    let declared = declared
+        .ok_or_else(|| io::Error::new(io::ErrorKind::InvalidInput, "LISTEN_FDS is missing"))?
+        .parse::<usize>()
+        .map_err(|_| {
+            io::Error::new(
+                io::ErrorKind::InvalidInput,
+                "LISTEN_FDS is not a valid integer",
+            )
+        })?;
+    if declared != expected || declared > MAX_ACTIVATION_LISTENERS {
+        return Err(io::Error::new(
+            io::ErrorKind::InvalidInput,
+            format!(
+                "expected {expected} inherited listener(s), but LISTEN_FDS declares {declared}"
+            ),
+        ));
+    }
+    Ok(())
 }
 
 #[cfg(not(target_os = "linux"))]
@@ -109,6 +178,32 @@ mod tests {
         assert_eq!(listener.local_addr().unwrap(), expected);
     }
 
+    #[test]
+    fn rejects_non_tcp_stream_protocol() {
+        let error = validate_tcp_listener_properties(
+            2,
+            rustix::net::SocketType::STREAM,
+            Some(rustix::net::ipproto::UDP),
+            true,
+        )
+        .unwrap_err();
+
+        assert!(error.to_string().contains("index 2 does not use TCP"));
+    }
+
+    #[test]
+    fn bounds_declared_listener_count_before_descriptor_receipt() {
+        assert!(validate_declared_count(1, Some("1")).is_ok());
+        assert!(validate_declared_count(0, Some("0")).is_err());
+        assert!(validate_declared_count(129, Some("129")).is_err());
+        assert!(validate_declared_count(1, None).is_err());
+        assert!(validate_declared_count(1, Some("invalid")).is_err());
+        assert!(validate_declared_count(1, Some("2")).is_err());
+        assert!(
+            validate_declared_count(1, Some("184467440737095516160000000000000000000")).is_err()
+        );
+    }
+
     #[test]
     fn rejects_owned_connected_tcp_stream() {
         let listener = TcpListener::bind("127.0.0.1:0").unwrap();
diff --git a/docs/zero-downtime-upgrades.md b/docs/zero-downtime-upgrades.md
@@ -65,8 +65,10 @@ for activated production listeners.
 Descriptor receipt never clears or changes `LISTEN_PID`, `LISTEN_FDS`, or
 `LISTEN_FDNAMES`. Mutating process environment storage after Tokio worker
 threads exist is not memory-safe on Unix. The focused `fluxheim-systemd` crate
-uses non-mutating libsystemd receipt and contains the single audited raw-FD
-ownership transfer required to construct owned Rust listeners.
+independently bounds the declared listener count before non-mutating libsystemd
+receipt, explicitly verifies `SOCK_STREAM`, `SO_PROTOCOL=TCP`, internet-family,
+and listening state, and contains the single audited raw-FD ownership transfer
+required to construct owned Rust listeners.
 
 Descriptor adoption is process-wide and one-shot. Concurrent or repeated
 calls fail before reading FD 3. Fluxheim converts the complete declared set to
diff --git a/release-notes/RELEASE_NOTES_1.7.12.md b/release-notes/RELEASE_NOTES_1.7.12.md
@@ -140,6 +140,15 @@ trailers are not part of this release.
 - Bound storage-bin manifests to 4 KiB and use no-follow, nonblocking regular
   file reads so oversized or special persistent files fail closed at startup.
 
+## Socket-Activation Hardening
+
+- Bound `LISTEN_FDS` to 1 through 128 inside the focused systemd adoption crate
+  before libsystemd can allocate descriptor storage, independently preserving
+  the root runtime's existing launch-environment validation.
+- Require every inherited internet stream listener to report
+  `SO_PROTOCOL=TCP`, in addition to the existing socket-family, stream-type,
+  listening-state, planned-address, and one-shot ownership checks.
+
 ## Reproducible FIPS-Backend Evidence
 
 - Add separately pinned OpenSSL-FIPS and rustls/AWS-LC-FIPS proof
@@ -180,3 +189,6 @@ platform, configuration, key handling, and required compliance evidence.
   slash encodings, encoded Unicode controls, and valid encoded Unicode.
 - Static-web tests cover missing children below valid and broken symlinked
   parents plus hidden non-UTF-8 Unix filenames.
+- Systemd unit and process-level smoke coverage verifies explicit TCP protocol
+  admission, bounded declarations before receipt, one-shot ownership,
+  complete-set closure on validation failure, and normal listener adoption.
diff --git a/scripts/smoke_systemd_socket_activation.sh b/scripts/smoke_systemd_socket_activation.sh
@@ -103,6 +103,17 @@ os.execve(binary, [binary, mode], environment)
 PY
 done
 
+python3 - "$ownership_probe" <<'PY'
+import os
+import sys
+
+binary = sys.argv[1]
+environment = os.environ.copy()
+environment["LISTEN_FDS"] = "129"
+environment["LISTEN_PID"] = str(os.getpid())
+os.execve(binary, [binary, "oversized-declaration"], environment)
+PY
+
 python3 - "$ownership_probe" <<'PY'
 import os
 import socket
diff --git a/scripts/validate-systemd-activation-policy.sh b/scripts/validate-systemd-activation-policy.sh
@@ -8,6 +8,17 @@ if ! rg -q 'receive_descriptors\(false\)' "$boundary"; then
     echo "systemd activation policy: descriptor receipt must preserve LISTEN_*" >&2
     exit 1
 fi
+preflight_line=$(rg -n 'validate_declared_count\(expected, activation_listener_declaration\(\)\?\.as_deref\(\)\)\?;' "$boundary" | cut -d: -f1 || true)
+receipt_line=$(rg -n 'receive_descriptors\(false\)' "$boundary" | cut -d: -f1 || true)
+if [ -z "$preflight_line" ] || [ -z "$receipt_line" ] || [ "$preflight_line" -ge "$receipt_line" ]; then
+    echo "systemd activation policy: LISTEN_FDS must be bounded before descriptor receipt" >&2
+    exit 1
+fi
+if ! rg -q 'socket_protocol\(&owned\)\?' "$boundary" \
+    || ! rg -q 'protocol != Some\(rustix::net::ipproto::TCP\)' "$boundary"; then
+    echo "systemd activation policy: inherited stream descriptors must explicitly use TCP" >&2
+    exit 1
+fi
 if ! rg -q 'static ACTIVATION_CONSUMED: AtomicBool' "$boundary" \
     || ! rg -q '\.compare_exchange\(false, true, Ordering::AcqRel, Ordering::Acquire\)' "$boundary"; then
     echo "systemd activation policy: descriptor ownership must be process-wide and one-shot" >&2
