From 1135bfdf999e2f1c115a557531d53c95451c76aa Mon Sep 17 00:00:00 2001
From: Minh Vu <vuhoangminh97@gmail.com>
Date: Fri, 10 Jul 2026 00:50:30 +0200
Subject: [PATCH] Handle unnamed macOS Unix sockets

---
 lib/vm.rs | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/lib/vm.rs b/lib/vm.rs
index c02f657..d2682f1 100644
--- a/lib/vm.rs
+++ b/lib/vm.rs
@@ -95,7 +95,11 @@ fn validate_vm_fd(vm_fd: RawFd) -> Result<()> {
         });
     }
 
-    if address.ss_family as libc::c_int != libc::AF_UNIX {
+    // macOS returns a zero-length address for unnamed UNIX-domain sockets,
+    // including socketpair descriptors. Other socket families return their
+    // address family when getsockname succeeds.
+    let is_unix_socket = address_len == 0 || address.ss_family as libc::c_int == libc::AF_UNIX;
+    if !is_unix_socket {
         bail!("VM file descriptor {vm_fd} is not a Unix socket");
     }
 
@@ -112,6 +116,7 @@ impl AsRawFd for VM {
 mod tests {
     use super::VM;
     use std::fs::File;
+    use std::net::UdpSocket;
     use std::os::fd::AsRawFd;
     use std::os::unix::net::{UnixDatagram, UnixStream};
 
@@ -157,6 +162,14 @@ mod tests {
         assert!(error.to_string().contains("not a Unix datagram socket"));
     }
 
+    #[test]
+    fn test_new_rejects_internet_datagram_socket() {
+        let socket = UdpSocket::bind("127.0.0.1:0").unwrap();
+        let error = VM::new(socket.as_raw_fd()).err().unwrap();
+
+        assert!(error.to_string().contains("not a Unix socket"));
+    }
+
     #[test]
     fn test_new_does_not_close_original_fd_when_vm_is_dropped() {
         let (socket, _peer) = UnixDatagram::pair().unwrap();