Method handleAccept

cmd/run/engine/process/handle.go:411–457

handleAccept handles the accept(2) and accept4(2) syscalls.

(n *seccomp.Notif, fd int, addrPtr uintptr, addrSizePtr uintptr, flags int)

// handleAccept handles the accept(2) and accept4(2) syscalls.
func (p *Process) handleAccept(n *seccomp.Notif, fd int, addrPtr uintptr, addrSizePtr uintptr, flags int) error {
	s, ok := p.getSocket(fd)
	if !ok {
		return n.Skip()
	}

	ret, errno, err := s.Accept(flags)
	if err != nil {
		return fmt.Errorf("accept socket: %w", err)
	}
	if errno != 0 {
		return n.Return(0, errno)
	}

	if addrPtr != 0 && addrSizePtr != 0 {
		peer, errno, err := ret.PeerAddr()
		if err != nil {
			return fmt.Errorf("get peer addr of accepted socket: %w", err)
		}
		if errno != 0 {
			return n.Return(0, errno)
		}

		if s.Inode.Domain == unix.AF_INET6 && peer.Addr().Is4() {
			// `python -m http.server -b ::` followed by `curl -4 localhost:8000`
			// reports the client address as ::ffff:127.0.0.1, not the IPv4 address.
			peer = netip.AddrPortFrom(netip.AddrFrom16(peer.Addr().As16()), peer.Port())
		}

		errno, err = p.vmWriteSockaddr(n, peer, addrPtr, addrSizePtr)
		if err != nil {
			return fmt.Errorf("write sock addr: %w", err)
		}
		if errno != 0 {
			// TODO(adtac): gvisor [0] says Linux doesn't give you an error here, but
			// it looks like the kernel source code does [1]. Check who is right here.
			// [0] https://github.com/google/gvisor/blob/7b151e25d076b81480456069917baffc2808578f/pkg/sentry/syscalls/linux/sys_socket.go#L313
			// [1] https://elixir.bootlin.com/linux/v6.7/source/net/socket.c#L1942
			return n.Return(0, errno)
		}
	}

	if err := p.installSocket(n, ret, flags&unix.SOCK_CLOEXEC); err != nil {
		return fmt.Errorf("install socket: %w", err)
	}
	return nil
}

// handleGetsockopt handles the getsockopt(2) syscall to emulate SO_ERROR.
func (p *Process) handleGetsockopt(n *seccomp.Notif, fd int, level int, name int, valPtr uintptr, valSizePtr uintptr) error {