Function resolve_owner_identity

crates/openshell-supervisor-network/src/proxy.rs:1415–1464

(
    owner_pid: u32,
    entrypoint_pid: u32,
    identity_cache: &BinaryIdentityCache,
)

#[cfg(target_os = "linux")]
fn resolve_owner_identity(
    owner_pid: u32,
    entrypoint_pid: u32,
    identity_cache: &BinaryIdentityCache,
) -> std::result::Result<ResolvedIdentity, IdentityError> {
    let bin_path =
        crate::procfs::binary_path(owner_pid.cast_signed()).map_err(|e| IdentityError {
            reason: format!("failed to resolve peer binary for PID {owner_pid}: {e}"),
            binary: None,
            binary_pid: Some(owner_pid),
            ancestors: vec![],
        })?;

    let bin_hash = identity_cache
        .verify_or_cache(&bin_path)
        .map_err(|e| IdentityError {
            reason: format!("binary integrity check failed: {e}"),
            binary: Some(bin_path.clone()),
            binary_pid: Some(owner_pid),
            ancestors: vec![],
        })?;

    let ancestors = crate::procfs::collect_ancestor_binaries(owner_pid, entrypoint_pid);

    for ancestor in &ancestors {
        identity_cache
            .verify_or_cache(ancestor)
            .map_err(|e| IdentityError {
                reason: format!(
                    "ancestor integrity check failed for {}: {e}",
                    ancestor.display()
                ),
                binary: Some(bin_path.clone()),
                binary_pid: Some(owner_pid),
                ancestors: ancestors.clone(),
            })?;
    }

    let mut exclude = ancestors.clone();
    exclude.push(bin_path.clone());
    let cmdline_paths = crate::procfs::collect_cmdline_paths(owner_pid, entrypoint_pid, &exclude);

    Ok(ResolvedIdentity {
        bin_path,
        binary_pid: owner_pid,
        ancestors,
        cmdline_paths,
        bin_hash,
    })
}

/// Resolve the identity of the process owning a TCP peer connection.
///