streamlocal: document security considerations for Simple callbacks

SimpleUnixLocalForwardingCallback and SimpleUnixReverseForwardingCallback
perform no validation on client-supplied socket paths. A malicious client
can request forwarding to arbitrary paths, which in the reverse case
causes directory creation (MkdirAll), file deletion (unlink), and socket
binding at the requested path.

Add prominent documentation warnings that these helpers are intended for
trusted environments and that production deployments should implement
custom callbacks with path validation and access control.

Updates gliderlabs#196

Author: kradalby

streamlocal.go

@@ -254,6 +254,12 @@ func unlink(path string) error {
 // SimpleUnixLocalForwardingCallback provides a basic implementation for
 // LocalUnixForwardingCallback. It will simply dial the requested socket using
 // a context-aware dialer.
+//
+// WARNING: this callback performs no validation on the socket path. A
+// malicious client can request forwarding to any Unix socket the server
+// process can access (e.g. /var/run/docker.sock). Production deployments
+// should implement a custom callback with path validation and access
+// control.
 func SimpleUnixLocalForwardingCallback(ctx Context, socketPath string) (net.Conn, error) {
 	var d net.Dialer
 	return d.DialContext(ctx, "unix", socketPath)
@@ -262,6 +268,12 @@ func SimpleUnixLocalForwardingCallback(ctx Context, socketPath string) (net.Conn
 // SimpleUnixReverseForwardingCallback provides a basic implementation for
 // ReverseUnixForwardingCallback. The parent directory will be created (with
 // os.MkdirAll), and existing files with the same name will be removed.
+//
+// WARNING: this callback performs no validation on the client-supplied
+// socket path. It will create parent directories, unlink existing files,
+// and bind a socket at any path the server process can write to.
+// Production deployments should implement a custom callback with path
+// validation, access control, and appropriate socket permissions.
 func SimpleUnixReverseForwardingCallback(ctx Context, socketPath string) (net.Listener, error) {
 	// Create socket parent dir if not exists.
 	parentDir := filepath.Dir(socketPath)