util: CVE-2012-2737: validate SetIconFile caller over bus

The AccountsService SetIconFile call associates an icon
with a user.

SetIconFile allows users to have icons visible at the login
screen that don't necessarily originate in globally
readable or always available locations. This is accomplished
by copying the originating icon to the local disk in /var.

Since AccountsService runs with with root privileges, the
implemention of the SetIconFile method queries the uid of
the method caller, forks, switches to that uid and performs
the image copy as if it were the user.

Unfortunately, the uid lookup peformed is done "just in time"
instead of looking at peer credentials from the time the call
was initiated. There is a race condition that means a caller
could invoke the method call, quickly exec a setuid binary, and
then cause the copy to be performed as the uid of the setuid
process.

This commit changes the uid lookup logic to query the system
bus daemon for the peer credentials that were cached from the
caller at the time of the initial connection.
user: CVE-2012-2737: verify caller through bus in more cases

The previous commit changed the SetIconFile call to identify
the uid of the calling process via cached peer credentials
stored by the bus daemon.

This commit fixes other similar cases where we try to figure
out process identity on our own instead of through the bus
daemon.
util: CVE-2012-2737: drop _polkit_subject_get_cmdline

_polkit_subject_get_cmdline is a function copy and pasted
from the polkit code that returns the command line, uid, and
pid of a particular polkit subject.  It's used for helping to
generate log entries that detail what processes are invoking methods
on the accounts service.

It's also used, on older kernels, for setting up the the loginuid
of subprocesses that are run on behalf of AccountsService clients,
so the audit trail leads back to the user initiating a request.

_polkit_subject_get_cmdline directly looks up the uid of the caller,
instead of querying the system bus.  As such, it's vulnerable to
the same race condition discussed in the previous two commits.

This commit guts _polkit_subject_get_cmdline, keeping only the part
that reads /proc/pid/cmdline. We now get the uid and pid from the
bus daemon.
NEWS: update for release
configure: bump to 0.6.22
lib: fix some debug spew

It was one of those "Blah failed: Success" situations
daemon: Refactor reloading of users from multiple sources

This commit reworks how the list of users is accumulated.

It introduces the idea of an "entry generator" which returns
struct passwd entries repeatedly until all entries available
are returned.  It then reworks the wtmp and /etc/passwd
reading to work in terms of entry generators.

This refactor will make it easier to introduce other sources
of users.

https://bugs.freedesktop.org/show_bug.cgi?id=50770
daemon: add all users from cachedir to ListCachedUsers result

The cachedir /var/lib/AccountsService/users/ contains a list of
files named after user accounts.  These files contain metadata
about the user.

This commit changes the code to consider the presence of one of
these cache files as evidence of a user account, and uses that
information to augment the list of users returned by ListCachedUsers.

This prevents network-login users from "falling off the map" if the
wtmp file is rotated.

It's also a prerequisite for adding support for an explicit
CacheUser() call. That call will be introduced in a subsequent
commit.

https://bugs.freedesktop.org/show_bug.cgi?id=50770
add CacheUser() and UncacheUser() methods

This commit introduces a CacheUser() method, which explicitly
makes a user show up in the results of a ListCachedUsers call
provided the user is otherwise known to the system.

This commit also introduces an UncacheUser() method to undo
what CacheUser() does.

https://bugs.freedesktop.org/show_bug.cgi?id=50770
daemon: uncache user before deleting user

When deleting a user account it's important to clean up our
cache file on the user even if userdel fails.  userdel only
works on local users, and we want DeleteUser() when called
on remote users to behave something like UncacheUser().

This commit rearranges the order in which we delete the users
cache files versus delete the user, such that the cache files
are always deleted.

https://bugs.freedesktop.org/show_bug.cgi?id=50770
NEWS: update for release
configure: bump to 0.6.23
Rename user_local_xxxx() to user_xxxx()

 * Since User* applies to remote users too, and the 'local'
   terminology can be confusing.

https://bugs.freedesktop.org/show_bug.cgi?id=51037
Add User.Local dbus property

This property describes whether the user account is local to the machine
or not, and thus can be managed with usermod, userdel and so on.

We currently implement this as a heuristic. If it's found in /etc/passwd
then we treat it as 'local'

https://bugs.freedesktop.org/show_bug.cgi?id=51037
lib: drop act_user_set_property

All the properties are read-only.

This fixes a compiler warning.
lib: drop return value from update_info

It unconditionally returns TRUE, so the return
value is useless.

This fixes a compiler warning.
NEWS: update for release
configure: bump to 0.6.24
user-manager: Guard against NULL users

If you call act_user_manager_delete_user (manager, NULL, TRUE, &error);
you'll accidentally delete the root user. Oops.
util: Fix an uninitialized variable