Rust fd://3 socket activation adopts the fd blindly — no validation it is a listening socket

[abienkowski]

Summary

With --listen-socket=fd://3, the Rust implementation adopts fd 3 via from_raw_fd without verifying it is actually a listening AF_UNIX socket. Go's net.FileListener (go/main.go:78) rejects non-socket fds; Rust only surfaces the problem later as io::Error from set_nonblocking/accept (mitigated by the accept-error backoff added in #27 — no busy loop, but also no clear early failure).

Neither implementation checks the LISTEN_PID/LISTEN_FDS environment variables from the sd_listen_fds convention, so this is parity-plus hardening.

Affected implementation(s)

• Rust
• Go (partially validates via net.FileListener; also skips LISTEN_FDS env check)

Expected behavior

--listen-socket=fd://3 with an fd that is not a listening AF_UNIX socket should fail fast at startup with a clear error, not degrade into accept errors at runtime.

Suggested fix

Before adopting the fd:

• fstat and check S_IFSOCK
• getsockopt(SOL_SOCKET, SO_ACCEPTCONN) to confirm it is listening
• Optionally validate LISTEN_PID == getpid() and LISTEN_FDS >= 1 per the systemd convention (would also make sense in Go for parity)

Also worth a subprocess-based test that dup2s a real listener onto fd 3 and exercises the fd://3 dispatch path end-to-end (currently only the fd-wrapping helper is unit-tested).

Context

Split out from the review follow-ups on PR #27. Related: #25, #28.