Convert Unix transport to syserr

Previously this code used the tcpip error space. Since it is no longer part of
netstack, it can use the sentry's error space (except for a few cases where
there is still some shared code. This reduces the number of error space
conversions required for hot Unix socket operations.

PiperOrigin-RevId: 218541611
Change-Id: I3d13047006a8245b5dfda73364d37b8a453784bb

7 files changed, 96 insertions, 93 deletions

diff --git a/pkg/sentry/socket/unix/io.go b/pkg/sentry/socket/unix/io.go
index 7d6434696..7d80e4393 100644
--- a/pkg/sentry/socket/unix/io.go
+++ b/pkg/sentry/socket/unix/io.go
@@ -17,7 +17,6 @@ package unix
 import (
 	"gvisor.googlesource.com/gvisor/pkg/sentry/safemem"
 	"gvisor.googlesource.com/gvisor/pkg/sentry/socket/unix/transport"
-	"gvisor.googlesource.com/gvisor/pkg/syserr"
 	"gvisor.googlesource.com/gvisor/pkg/tcpip"
 )
 
@@ -40,7 +39,7 @@ func (w *EndpointWriter) WriteFromBlocks(srcs safemem.BlockSeq) (uint64, error)
 	return safemem.FromVecWriterFunc{func(bufs [][]byte) (int64, error) {
 		n, err := w.Endpoint.SendMsg(bufs, w.Control, w.To)
 		if err != nil {
-			return int64(n), syserr.TranslateNetstackError(err).ToError()
+			return int64(n), err.ToError()
 		}
 		return int64(n), nil
 	}}.WriteFromBlocks(srcs)
@@ -82,7 +81,7 @@ func (r *EndpointReader) ReadToBlocks(dsts safemem.BlockSeq) (uint64, error) {
 		r.Control = c
 		r.MsgSize = ms
 		if err != nil {
-			return int64(n), syserr.TranslateNetstackError(err).ToError()
+			return int64(n), err.ToError()
 		}
 		return int64(n), nil
 	}}.ReadToBlocks(dsts)
diff --git a/pkg/sentry/socket/unix/transport/BUILD b/pkg/sentry/socket/unix/transport/BUILD
index 5bc01e3c8..5a90837bc 100644
--- a/pkg/sentry/socket/unix/transport/BUILD
+++ b/pkg/sentry/socket/unix/transport/BUILD
@@ -30,6 +30,7 @@ go_library(
     deps = [
         "//pkg/ilist",
         "//pkg/refs",
+        "//pkg/syserr",
         "//pkg/tcpip",
         "//pkg/tcpip/buffer",
         "//pkg/waiter",
diff --git a/pkg/sentry/socket/unix/transport/connectioned.go b/pkg/sentry/socket/unix/transport/connectioned.go
index 83b50459f..7cfbbfe8a 100644
--- a/pkg/sentry/socket/unix/transport/connectioned.go
+++ b/pkg/sentry/socket/unix/transport/connectioned.go
@@ -17,6 +17,7 @@ package transport
 import (
 	"sync"
 
+	"gvisor.googlesource.com/gvisor/pkg/syserr"
 	"gvisor.googlesource.com/gvisor/pkg/tcpip"
 	"gvisor.googlesource.com/gvisor/pkg/waiter"
 )
@@ -236,14 +237,14 @@ func (e *connectionedEndpoint) Close() {
 }
 
 // BidirectionalConnect implements BoundEndpoint.BidirectionalConnect.
-func (e *connectionedEndpoint) BidirectionalConnect(ce ConnectingEndpoint, returnConnect func(Receiver, ConnectedEndpoint)) *tcpip.Error {
+func (e *connectionedEndpoint) BidirectionalConnect(ce ConnectingEndpoint, returnConnect func(Receiver, ConnectedEndpoint)) *syserr.Error {
 	if ce.Type() != e.stype {
-		return tcpip.ErrConnectionRefused
+		return syserr.ErrConnectionRefused
 	}
 
 	// Check if ce is e to avoid a deadlock.
 	if ce, ok := ce.(*connectionedEndpoint); ok && ce == e {
-		return tcpip.ErrInvalidEndpointState
+		return syserr.ErrInvalidEndpointState
 	}
 
 	// Do a dance to safely acquire locks on both endpoints.
@@ -259,19 +260,19 @@ func (e *connectionedEndpoint) BidirectionalConnect(ce ConnectingEndpoint, retur
 	if ce.Connected() {
 		e.Unlock()
 		ce.Unlock()
-		return tcpip.ErrAlreadyConnected
+		return syserr.ErrAlreadyConnected
 	}
 	if ce.Listening() {
 		e.Unlock()
 		ce.Unlock()
-		return tcpip.ErrInvalidEndpointState
+		return syserr.ErrInvalidEndpointState
 	}
 
 	// Check bound state.
 	if !e.Listening() {
 		e.Unlock()
 		ce.Unlock()
-		return tcpip.ErrConnectionRefused
+		return syserr.ErrConnectionRefused
 	}
 
 	// Create a newly bound connectionedEndpoint.
@@ -327,18 +328,18 @@ func (e *connectionedEndpoint) BidirectionalConnect(ce ConnectingEndpoint, retur
 		ne.Close()
 		e.Unlock()
 		ce.Unlock()
-		return tcpip.ErrConnectionRefused
+		return syserr.ErrConnectionRefused
 	}
 }
 
 // UnidirectionalConnect implements BoundEndpoint.UnidirectionalConnect.
-func (e *connectionedEndpoint) UnidirectionalConnect() (ConnectedEndpoint, *tcpip.Error) {
-	return nil, tcpip.ErrConnectionRefused
+func (e *connectionedEndpoint) UnidirectionalConnect() (ConnectedEndpoint, *syserr.Error) {
+	return nil, syserr.ErrConnectionRefused
 }
 
 // Connect attempts to directly connect to another Endpoint.
 // Implements Endpoint.Connect.
-func (e *connectionedEndpoint) Connect(server BoundEndpoint) *tcpip.Error {
+func (e *connectionedEndpoint) Connect(server BoundEndpoint) *syserr.Error {
 	returnConnect := func(r Receiver, ce ConnectedEndpoint) {
 		e.receiver = r
 		e.connected = ce
@@ -348,14 +349,14 @@ func (e *connectionedEndpoint) Connect(server BoundEndpoint) *tcpip.Error {
 }
 
 // Listen starts listening on the connection.
-func (e *connectionedEndpoint) Listen(backlog int) *tcpip.Error {
+func (e *connectionedEndpoint) Listen(backlog int) *syserr.Error {
 	e.Lock()
 	defer e.Unlock()
 	if e.Listening() {
 		// Adjust the size of the channel iff we can fix existing
 		// pending connections into the new one.
 		if len(e.acceptedChan) > backlog {
-			return tcpip.ErrInvalidEndpointState
+			return syserr.ErrInvalidEndpointState
 		}
 		origChan := e.acceptedChan
 		e.acceptedChan = make(chan *connectionedEndpoint, backlog)
@@ -366,7 +367,7 @@ func (e *connectionedEndpoint) Listen(backlog int) *tcpip.Error {
 		return nil
 	}
 	if !e.isBound() {
-		return tcpip.ErrInvalidEndpointState
+		return syserr.ErrInvalidEndpointState
 	}
 
 	// Normal case.
@@ -375,12 +376,12 @@ func (e *connectionedEndpoint) Listen(backlog int) *tcpip.Error {
 }
 
 // Accept accepts a new connection.
-func (e *connectionedEndpoint) Accept() (Endpoint, *tcpip.Error) {
+func (e *connectionedEndpoint) Accept() (Endpoint, *syserr.Error) {
 	e.Lock()
 	defer e.Unlock()
 
 	if !e.Listening() {
-		return nil, tcpip.ErrInvalidEndpointState
+		return nil, syserr.ErrInvalidEndpointState
 	}
 
 	select {
@@ -389,7 +390,7 @@ func (e *connectionedEndpoint) Accept() (Endpoint, *tcpip.Error) {
 
 	default:
 		// Nothing left.
-		return nil, tcpip.ErrWouldBlock
+		return nil, syserr.ErrWouldBlock
 	}
 }
 
@@ -401,15 +402,15 @@ func (e *connectionedEndpoint) Accept() (Endpoint, *tcpip.Error) {
 //
 // Bind will fail only if the socket is connected, bound or the passed address
 // is invalid (the empty string).
-func (e *connectionedEndpoint) Bind(addr tcpip.FullAddress, commit func() *tcpip.Error) *tcpip.Error {
+func (e *connectionedEndpoint) Bind(addr tcpip.FullAddress, commit func() *syserr.Error) *syserr.Error {
 	e.Lock()
 	defer e.Unlock()
 	if e.isBound() || e.Listening() {
-		return tcpip.ErrAlreadyBound
+		return syserr.ErrAlreadyBound
 	}
 	if addr.Addr == "" {
 		// The empty string is not permitted.
-		return tcpip.ErrBadLocalAddress
+		return syserr.ErrBadLocalAddress
 	}
 	if commit != nil {
 		if err := commit(); err != nil {
@@ -424,11 +425,11 @@ func (e *connectionedEndpoint) Bind(addr tcpip.FullAddress, commit func() *tcpip
 
 // SendMsg writes data and a control message to the endpoint's peer.
 // This method does not block if the data cannot be written.
-func (e *connectionedEndpoint) SendMsg(data [][]byte, c ControlMessages, to BoundEndpoint) (uintptr, *tcpip.Error) {
+func (e *connectionedEndpoint) SendMsg(data [][]byte, c ControlMessages, to BoundEndpoint) (uintptr, *syserr.Error) {
 	// Stream sockets do not support specifying the endpoint. Seqpacket
 	// sockets ignore the passed endpoint.
 	if e.stype == SockStream && to != nil {
-		return 0, tcpip.ErrNotSupported
+		return 0, syserr.ErrNotSupported
 	}
 	return e.baseEndpoint.SendMsg(data, c, to)
 }
diff --git a/pkg/sentry/socket/unix/transport/connectionless.go b/pkg/sentry/socket/unix/transport/connectionless.go
index 376e4abb2..f432a9717 100644
--- a/pkg/sentry/socket/unix/transport/connectionless.go
+++ b/pkg/sentry/socket/unix/transport/connectionless.go
@@ -15,6 +15,7 @@
 package transport
 
 import (
+	"gvisor.googlesource.com/gvisor/pkg/syserr"
 	"gvisor.googlesource.com/gvisor/pkg/tcpip"
 	"gvisor.googlesource.com/gvisor/pkg/waiter"
 )
@@ -70,21 +71,21 @@ func (e *connectionlessEndpoint) Close() {
 }
 
 // BidirectionalConnect implements BoundEndpoint.BidirectionalConnect.
-func (e *connectionlessEndpoint) BidirectionalConnect(ce ConnectingEndpoint, returnConnect func(Receiver, ConnectedEndpoint)) *tcpip.Error {
-	return tcpip.ErrConnectionRefused
+func (e *connectionlessEndpoint) BidirectionalConnect(ce ConnectingEndpoint, returnConnect func(Receiver, ConnectedEndpoint)) *syserr.Error {
+	return syserr.ErrConnectionRefused
 }
 
 // UnidirectionalConnect implements BoundEndpoint.UnidirectionalConnect.
-func (e *connectionlessEndpoint) UnidirectionalConnect() (ConnectedEndpoint, *tcpip.Error) {
+func (e *connectionlessEndpoint) UnidirectionalConnect() (ConnectedEndpoint, *syserr.Error) {
 	e.Lock()
 	r := e.receiver
 	e.Unlock()
 	if r == nil {
-		return nil, tcpip.ErrConnectionRefused
+		return nil, syserr.ErrConnectionRefused
 	}
 	q := r.(*queueReceiver).readQueue
 	if !q.TryIncRef() {
-		return nil, tcpip.ErrConnectionRefused
+		return nil, syserr.ErrConnectionRefused
 	}
 	return &connectedEndpoint{
 		endpoint:   e,
@@ -94,14 +95,14 @@ func (e *connectionlessEndpoint) UnidirectionalConnect() (ConnectedEndpoint, *tc
 
 // SendMsg writes data and a control message to the specified endpoint.
 // This method does not block if the data cannot be written.
-func (e *connectionlessEndpoint) SendMsg(data [][]byte, c ControlMessages, to BoundEndpoint) (uintptr, *tcpip.Error) {
+func (e *connectionlessEndpoint) SendMsg(data [][]byte, c ControlMessages, to BoundEndpoint) (uintptr, *syserr.Error) {
 	if to == nil {
 		return e.baseEndpoint.SendMsg(data, c, nil)
 	}
 
 	connected, err := to.UnidirectionalConnect()
 	if err != nil {
-		return 0, tcpip.ErrInvalidEndpointState
+		return 0, syserr.ErrInvalidEndpointState
 	}
 	defer connected.Release()
 
@@ -122,7 +123,7 @@ func (e *connectionlessEndpoint) Type() SockType {
 }
 
 // Connect attempts to connect directly to server.
-func (e *connectionlessEndpoint) Connect(server BoundEndpoint) *tcpip.Error {
+func (e *connectionlessEndpoint) Connect(server BoundEndpoint) *syserr.Error {
 	connected, err := server.UnidirectionalConnect()
 	if err != nil {
 		return err
@@ -136,13 +137,13 @@ func (e *connectionlessEndpoint) Connect(server BoundEndpoint) *tcpip.Error {
 }
 
 // Listen starts listening on the connection.
-func (e *connectionlessEndpoint) Listen(int) *tcpip.Error {
-	return tcpip.ErrNotSupported
+func (e *connectionlessEndpoint) Listen(int) *syserr.Error {
+	return syserr.ErrNotSupported
 }
 
 // Accept accepts a new connection.
-func (e *connectionlessEndpoint) Accept() (Endpoint, *tcpip.Error) {
-	return nil, tcpip.ErrNotSupported
+func (e *connectionlessEndpoint) Accept() (Endpoint, *syserr.Error) {
+	return nil, syserr.ErrNotSupported
 }
 
 // Bind binds the connection.
@@ -153,15 +154,15 @@ func (e *connectionlessEndpoint) Accept() (Endpoint, *tcpip.Error) {
 //
 // Bind will fail only if the socket is connected, bound or the passed address
 // is invalid (the empty string).
-func (e *connectionlessEndpoint) Bind(addr tcpip.FullAddress, commit func() *tcpip.Error) *tcpip.Error {
+func (e *connectionlessEndpoint) Bind(addr tcpip.FullAddress, commit func() *syserr.Error) *syserr.Error {
 	e.Lock()
 	defer e.Unlock()
 	if e.isBound() {
-		return tcpip.ErrAlreadyBound
+		return syserr.ErrAlreadyBound
 	}
 	if addr.Addr == "" {
 		// The empty string is not permitted.
-		return tcpip.ErrBadLocalAddress
+		return syserr.ErrBadLocalAddress
 	}
 	if commit != nil {
 		if err := commit(); err != nil {
diff --git a/pkg/sentry/socket/unix/transport/queue.go b/pkg/sentry/socket/unix/transport/queue.go
index 72aa409ab..05d1bdeef 100644
--- a/pkg/sentry/socket/unix/transport/queue.go
+++ b/pkg/sentry/socket/unix/transport/queue.go
@@ -18,7 +18,7 @@ import (
 	"sync"
 
 	"gvisor.googlesource.com/gvisor/pkg/refs"
-	"gvisor.googlesource.com/gvisor/pkg/tcpip"
+	"gvisor.googlesource.com/gvisor/pkg/syserr"
 	"gvisor.googlesource.com/gvisor/pkg/waiter"
 )
 
@@ -110,12 +110,12 @@ func (q *queue) IsWritable() bool {
 //
 // If notify is true, ReaderQueue.Notify must be called:
 // q.ReaderQueue.Notify(waiter.EventIn)
-func (q *queue) Enqueue(e *message, truncate bool) (l int64, notify bool, err *tcpip.Error) {
+func (q *queue) Enqueue(e *message, truncate bool) (l int64, notify bool, err *syserr.Error) {
 	q.mu.Lock()
 
 	if q.closed {
 		q.mu.Unlock()
-		return 0, false, tcpip.ErrClosedForSend
+		return 0, false, syserr.ErrClosedForSend
 	}
 
 	free := q.limit - q.used
@@ -126,24 +126,24 @@ func (q *queue) Enqueue(e *message, truncate bool) (l int64, notify bool, err *t
 		if free == 0 {
 			// Message can't fit right now.
 			q.mu.Unlock()
-			return 0, false, tcpip.ErrWouldBlock
+			return 0, false, syserr.ErrWouldBlock
 		}
 
 		e.Truncate(free)
 		l = e.Length()
-		err = tcpip.ErrWouldBlock
+		err = syserr.ErrWouldBlock
 	}
 
 	if l > q.limit {
 		// Message is too big to ever fit.
 		q.mu.Unlock()
-		return 0, false, tcpip.ErrMessageTooLong
+		return 0, false, syserr.ErrMessageTooLong
 	}
 
 	if l > free {
 		// Message can't fit right now.
 		q.mu.Unlock()
-		return 0, false, tcpip.ErrWouldBlock
+		return 0, false, syserr.ErrWouldBlock
 	}
 
 	notify = q.dataList.Front() == nil
@@ -159,13 +159,13 @@ func (q *queue) Enqueue(e *message, truncate bool) (l int64, notify bool, err *t
 //
 // If notify is true, WriterQueue.Notify must be called:
 // q.WriterQueue.Notify(waiter.EventOut)
-func (q *queue) Dequeue() (e *message, notify bool, err *tcpip.Error) {
+func (q *queue) Dequeue() (e *message, notify bool, err *syserr.Error) {
 	q.mu.Lock()
 
 	if q.dataList.Front() == nil {
-		err := tcpip.ErrWouldBlock
+		err := syserr.ErrWouldBlock
 		if q.closed {
-			err = tcpip.ErrClosedForReceive
+			err = syserr.ErrClosedForReceive
 		}
 		q.mu.Unlock()
 
@@ -186,14 +186,14 @@ func (q *queue) Dequeue() (e *message, notify bool, err *tcpip.Error) {
 }
 
 // Peek returns the first entry in the data queue, if one exists.
-func (q *queue) Peek() (*message, *tcpip.Error) {
+func (q *queue) Peek() (*message, *syserr.Error) {
 	q.mu.Lock()
 	defer q.mu.Unlock()
 
 	if q.dataList.Front() == nil {
-		err := tcpip.ErrWouldBlock
+		err := syserr.ErrWouldBlock
 		if q.closed {
-			err = tcpip.ErrClosedForReceive
+			err = syserr.ErrClosedForReceive
 		}
 		return nil, err
 	}
diff --git a/pkg/sentry/socket/unix/transport/unix.go b/pkg/sentry/socket/unix/transport/unix.go
index 765cca27a..e98096d7b 100644
--- a/pkg/sentry/socket/unix/transport/unix.go
+++ b/pkg/sentry/socket/unix/transport/unix.go
@@ -19,6 +19,7 @@ import (
 	"sync"
 	"sync/atomic"
 
+	"gvisor.googlesource.com/gvisor/pkg/syserr"
 	"gvisor.googlesource.com/gvisor/pkg/tcpip"
 	"gvisor.googlesource.com/gvisor/pkg/tcpip/buffer"
 	"gvisor.googlesource.com/gvisor/pkg/waiter"
@@ -129,13 +130,13 @@ type Endpoint interface {
 	//
 	// msgLen is the length of the read message consumed for datagram Endpoints.
 	// msgLen is always the same as recvLen for stream Endpoints.
-	RecvMsg(data [][]byte, creds bool, numRights uintptr, peek bool, addr *tcpip.FullAddress) (recvLen, msgLen uintptr, cm ControlMessages, err *tcpip.Error)
+	RecvMsg(data [][]byte, creds bool, numRights uintptr, peek bool, addr *tcpip.FullAddress) (recvLen, msgLen uintptr, cm ControlMessages, err *syserr.Error)
 
 	// SendMsg writes data and a control message to the endpoint's peer.
 	// This method does not block if the data cannot be written.
 	//
 	// SendMsg does not take ownership of any of its arguments on error.
-	SendMsg([][]byte, ControlMessages, BoundEndpoint) (uintptr, *tcpip.Error)
+	SendMsg([][]byte, ControlMessages, BoundEndpoint) (uintptr, *syserr.Error)
 
 	// Connect connects this endpoint directly to another.
 	//
@@ -143,22 +144,22 @@ type Endpoint interface {
 	// endpoint passed in as a parameter.
 	//
 	// The error codes are the same as Connect.
-	Connect(server BoundEndpoint) *tcpip.Error
+	Connect(server BoundEndpoint) *syserr.Error
 
 	// Shutdown closes the read and/or write end of the endpoint connection
 	// to its peer.
-	Shutdown(flags tcpip.ShutdownFlags) *tcpip.Error
+	Shutdown(flags tcpip.ShutdownFlags) *syserr.Error
 
 	// Listen puts the endpoint in "listen" mode, which allows it to accept
 	// new connections.
-	Listen(backlog int) *tcpip.Error
+	Listen(backlog int) *syserr.Error
 
 	// Accept returns a new endpoint if a peer has established a connection
 	// to an endpoint previously set to listen mode. This method does not
 	// block if no new connections are available.
 	//
 	// The returned Queue is the wait queue for the newly created endpoint.
-	Accept() (Endpoint, *tcpip.Error)
+	Accept() (Endpoint, *syserr.Error)
 
 	// Bind binds the endpoint to a specific local address and port.
 	// Specifying a NIC is optional.
@@ -166,7 +167,7 @@ type Endpoint interface {
 	// An optional commit function will be executed atomically with respect
 	// to binding the endpoint. If this returns an error, the bind will not
 	// occur and the error will be propagated back to the caller.
-	Bind(address tcpip.FullAddress, commit func() *tcpip.Error) *tcpip.Error
+	Bind(address tcpip.FullAddress, commit func() *syserr.Error) *syserr.Error
 
 	// Type return the socket type, typically either SockStream, SockDgram
 	// or SockSeqpacket.
@@ -218,9 +219,9 @@ type BoundEndpoint interface {
 	// be unconnected and not listening and the BoundEndpoint whose
 	// BidirectionalConnect method is being called must be listening.
 	//
-	// This method will return tcpip.ErrConnectionRefused on endpoints with a
+	// This method will return syserr.ErrConnectionRefused on endpoints with a
 	// type that isn't SockStream or SockSeqpacket.
-	BidirectionalConnect(ep ConnectingEndpoint, returnConnect func(Receiver, ConnectedEndpoint)) *tcpip.Error
+	BidirectionalConnect(ep ConnectingEndpoint, returnConnect func(Receiver, ConnectedEndpoint)) *syserr.Error
 
 	// UnidirectionalConnect establishes a write-only connection to a unix
 	// endpoint.
@@ -228,9 +229,9 @@ type BoundEndpoint interface {
 	// An endpoint which calls UnidirectionalConnect and supports it itself must
 	// not hold its own lock when calling UnidirectionalConnect.
 	//
-	// This method will return tcpip.ErrConnectionRefused on a non-SockDgram
+	// This method will return syserr.ErrConnectionRefused on a non-SockDgram
 	// endpoint.
-	UnidirectionalConnect() (ConnectedEndpoint, *tcpip.Error)
+	UnidirectionalConnect() (ConnectedEndpoint, *syserr.Error)
 
 	// Release releases any resources held by the BoundEndpoint. It must be
 	// called before dropping all references to a BoundEndpoint returned by a
@@ -287,7 +288,7 @@ type Receiver interface {
 	// See Endpoint.RecvMsg for documentation on shared arguments.
 	//
 	// notify indicates if RecvNotify should be called.
-	Recv(data [][]byte, creds bool, numRights uintptr, peek bool) (recvLen, msgLen uintptr, cm ControlMessages, source tcpip.FullAddress, notify bool, err *tcpip.Error)
+	Recv(data [][]byte, creds bool, numRights uintptr, peek bool) (recvLen, msgLen uintptr, cm ControlMessages, source tcpip.FullAddress, notify bool, err *syserr.Error)
 
 	// RecvNotify notifies the Receiver of a successful Recv. This must not be
 	// called while holding any endpoint locks.
@@ -327,10 +328,10 @@ type queueReceiver struct {
 }
 
 // Recv implements Receiver.Recv.
-func (q *queueReceiver) Recv(data [][]byte, creds bool, numRights uintptr, peek bool) (uintptr, uintptr, ControlMessages, tcpip.FullAddress, bool, *tcpip.Error) {
+func (q *queueReceiver) Recv(data [][]byte, creds bool, numRights uintptr, peek bool) (uintptr, uintptr, ControlMessages, tcpip.FullAddress, bool, *syserr.Error) {
 	var m *message
 	var notify bool
-	var err *tcpip.Error
+	var err *syserr.Error
 	if peek {
 		m, err = q.readQueue.Peek()
 	} else {
@@ -439,7 +440,7 @@ func (q *streamQueueReceiver) RecvMaxQueueSize() int64 {
 }
 
 // Recv implements Receiver.Recv.
-func (q *streamQueueReceiver) Recv(data [][]byte, wantCreds bool, numRights uintptr, peek bool) (uintptr, uintptr, ControlMessages, tcpip.FullAddress, bool, *tcpip.Error) {
+func (q *streamQueueReceiver) Recv(data [][]byte, wantCreds bool, numRights uintptr, peek bool) (uintptr, uintptr, ControlMessages, tcpip.FullAddress, bool, *syserr.Error) {
 	q.mu.Lock()
 	defer q.mu.Unlock()
 
@@ -560,9 +561,9 @@ type ConnectedEndpoint interface {
 	//
 	// notify indicates if SendNotify should be called.
 	//
-	// tcpip.ErrWouldBlock can be returned along with a partial write if
+	// syserr.ErrWouldBlock can be returned along with a partial write if
 	// the caller should block to send the rest of the data.
-	Send(data [][]byte, controlMessages ControlMessages, from tcpip.FullAddress) (n uintptr, notify bool, err *tcpip.Error)
+	Send(data [][]byte, controlMessages ControlMessages, from tcpip.FullAddress) (n uintptr, notify bool, err *syserr.Error)
 
 	// SendNotify notifies the ConnectedEndpoint of a successful Send. This
 	// must not be called while holding any endpoint locks.
@@ -630,7 +631,7 @@ func (e *connectedEndpoint) GetLocalAddress() (tcpip.FullAddress, *tcpip.Error)
 }
 
 // Send implements ConnectedEndpoint.Send.
-func (e *connectedEndpoint) Send(data [][]byte, controlMessages ControlMessages, from tcpip.FullAddress) (uintptr, bool, *tcpip.Error) {
+func (e *connectedEndpoint) Send(data [][]byte, controlMessages ControlMessages, from tcpip.FullAddress) (uintptr, bool, *syserr.Error) {
 	var l int64
 	for _, d := range data {
 		l += int64(len(d))
@@ -774,12 +775,12 @@ func (e *baseEndpoint) Connected() bool {
 }
 
 // RecvMsg reads data and a control message from the endpoint.
-func (e *baseEndpoint) RecvMsg(data [][]byte, creds bool, numRights uintptr, peek bool, addr *tcpip.FullAddress) (uintptr, uintptr, ControlMessages, *tcpip.Error) {
+func (e *baseEndpoint) RecvMsg(data [][]byte, creds bool, numRights uintptr, peek bool, addr *tcpip.FullAddress) (uintptr, uintptr, ControlMessages, *syserr.Error) {
 	e.Lock()
 
 	if e.receiver == nil {
 		e.Unlock()
-		return 0, 0, ControlMessages{}, tcpip.ErrNotConnected
+		return 0, 0, ControlMessages{}, syserr.ErrNotConnected
 	}
 
 	recvLen, msgLen, cms, a, notify, err := e.receiver.Recv(data, creds, numRights, peek)
@@ -800,15 +801,15 @@ func (e *baseEndpoint) RecvMsg(data [][]byte, creds bool, numRights uintptr, pee
 
 // SendMsg writes data and a control message to the endpoint's peer.
 // This method does not block if the data cannot be written.
-func (e *baseEndpoint) SendMsg(data [][]byte, c ControlMessages, to BoundEndpoint) (uintptr, *tcpip.Error) {
+func (e *baseEndpoint) SendMsg(data [][]byte, c ControlMessages, to BoundEndpoint) (uintptr, *syserr.Error) {
 	e.Lock()
 	if !e.Connected() {
 		e.Unlock()
-		return 0, tcpip.ErrNotConnected
+		return 0, syserr.ErrNotConnected
 	}
 	if to != nil {
 		e.Unlock()
-		return 0, tcpip.ErrAlreadyConnected
+		return 0, syserr.ErrAlreadyConnected
 	}
 
 	n, notify, err := e.connected.Send(data, c, tcpip.FullAddress{Addr: tcpip.Address(e.path)})
@@ -901,11 +902,11 @@ func (e *baseEndpoint) GetSockOpt(opt interface{}) *tcpip.Error {
 
 // Shutdown closes the read and/or write end of the endpoint connection to its
 // peer.
-func (e *baseEndpoint) Shutdown(flags tcpip.ShutdownFlags) *tcpip.Error {
+func (e *baseEndpoint) Shutdown(flags tcpip.ShutdownFlags) *syserr.Error {
 	e.Lock()
 	if !e.Connected() {
 		e.Unlock()
-		return tcpip.ErrNotConnected
+		return syserr.ErrNotConnected
 	}
 
 	if flags&tcpip.ShutdownRead != 0 {
diff --git a/pkg/sentry/socket/unix/unix.go b/pkg/sentry/socket/unix/unix.go
index 3543dd81f..334169372 100644
--- a/pkg/sentry/socket/unix/unix.go
+++ b/pkg/sentry/socket/unix/unix.go
@@ -147,7 +147,7 @@ func (s *SocketOperations) GetSockOpt(t *kernel.Task, level, name, outLen int) (
 // Listen implements the linux syscall listen(2) for sockets backed by
 // a transport.Endpoint.
 func (s *SocketOperations) Listen(t *kernel.Task, backlog int) *syserr.Error {
-	return syserr.TranslateNetstackError(s.ep.Listen(backlog))
+	return s.ep.Listen(backlog)
 }
 
 // blockingAccept implements a blocking version of accept(2), that is, if no
@@ -161,8 +161,8 @@ func (s *SocketOperations) blockingAccept(t *kernel.Task) (transport.Endpoint, *
 	// Try to accept the connection; if it fails, then wait until we get a
 	// notification.
 	for {
-		if ep, err := s.ep.Accept(); err != tcpip.ErrWouldBlock {
-			return ep, syserr.TranslateNetstackError(err)
+		if ep, err := s.ep.Accept(); err != syserr.ErrWouldBlock {
+			return ep, err
 		}
 
 		if err := t.Block(ch); err != nil {
@@ -177,8 +177,8 @@ func (s *SocketOperations) Accept(t *kernel.Task, peerRequested bool, flags int,
 	// Issue the accept request to get the new endpoint.
 	ep, err := s.ep.Accept()
 	if err != nil {
-		if err != tcpip.ErrWouldBlock || !blocking {
-			return 0, nil, 0, syserr.TranslateNetstackError(err)
+		if err != syserr.ErrWouldBlock || !blocking {
+			return 0, nil, 0, err
 		}
 
 		var err *syserr.Error
@@ -232,15 +232,15 @@ func (s *SocketOperations) Bind(t *kernel.Task, sockaddr []byte) *syserr.Error {
 		return syserr.ErrInvalidArgument
 	}
 
-	return syserr.TranslateNetstackError(s.ep.Bind(tcpip.FullAddress{Addr: tcpip.Address(p)}, func() *tcpip.Error {
+	return s.ep.Bind(tcpip.FullAddress{Addr: tcpip.Address(p)}, func() *syserr.Error {
 		// Is it abstract?
 		if p[0] == 0 {
 			if t.IsNetworkNamespaced() {
-				return tcpip.ErrInvalidEndpointState
+				return syserr.ErrInvalidEndpointState
 			}
 			if err := t.AbstractSockets().Bind(p[1:], bep, s); err != nil {
-				// tcpip.ErrPortInUse corresponds to EADDRINUSE.
-				return tcpip.ErrPortInUse
+				// syserr.ErrPortInUse corresponds to EADDRINUSE.
+				return syserr.ErrPortInUse
 			}
 		} else {
 			// The parent and name.
@@ -269,7 +269,7 @@ func (s *SocketOperations) Bind(t *kernel.Task, sockaddr []byte) *syserr.Error {
 				d, err = t.MountNamespace().FindInode(t, root, cwd, subPath, fs.DefaultTraversalLimit)
 				if err != nil {
 					// No path available.
-					return tcpip.ErrNoSuchFile
+					return syserr.ErrNoSuchFile
 				}
 				defer d.DecRef()
 				name = p[lastSlash+1:]
@@ -278,13 +278,13 @@ func (s *SocketOperations) Bind(t *kernel.Task, sockaddr []byte) *syserr.Error {
 			// Create the socket.
 			childDir, err := d.Bind(t, t.FSContext().RootDirectory(), name, bep, fs.FilePermissions{User: fs.PermMask{Read: true}})
 			if err != nil {
-				return tcpip.ErrPortInUse
+				return syserr.ErrPortInUse
 			}
 			childDir.DecRef()
 		}
 
 		return nil
-	}))
+	})
 }
 
 // extractEndpoint retrieves the transport.BoundEndpoint associated with a Unix
@@ -341,7 +341,7 @@ func (s *SocketOperations) Connect(t *kernel.Task, sockaddr []byte, blocking boo
 	defer ep.Release()
 
 	// Connect the server endpoint.
-	return syserr.TranslateNetstackError(s.ep.Connect(ep))
+	return s.ep.Connect(ep)
 }
 
 // Writev implements fs.FileOperations.Write.
@@ -350,8 +350,8 @@ func (s *SocketOperations) Write(ctx context.Context, _ *fs.File, src usermem.IO
 	ctrl := control.New(t, s.ep, nil)
 
 	if src.NumBytes() == 0 {
-		nInt, tcpipError := s.ep.SendMsg([][]byte{}, ctrl, nil)
-		return int64(nInt), syserr.TranslateNetstackError(tcpipError).ToError()
+		nInt, err := s.ep.SendMsg([][]byte{}, ctrl, nil)
+		return int64(nInt), err.ToError()
 	}
 
 	return src.CopyInTo(ctx, &EndpointWriter{
@@ -448,7 +448,7 @@ func (s *SocketOperations) Shutdown(t *kernel.Task, how int) *syserr.Error {
 	}
 
 	// Issue shutdown request.
-	return syserr.TranslateNetstackError(s.ep.Shutdown(f))
+	return s.ep.Shutdown(f)
 }
 
 // Read implements fs.FileOperations.Read.