kdbus.txt: more details on matches and rules

Signed-off-by: Daniel Mack <daniel@zonque.org>
connection: allow unlimited bus connections for privileged users

As described in https://code.google.com/p/d-bus/issues/detail?id=9 by
Simon McVittie:

  kdbus allows 256 connections per uid per bus, which the CAP_IPC_OWNER
  may exceed.

  This could get quite tight for the session bus: I currently have 46
  session bus connections, so I'm only an order of magnitude away from
  the limit. The session bus is currently restricted to its owning uid
  only, and even if other uids are allowed in (perhaps via restricted
  endpoints) for Android-style sandboxing, I expect it will be mostly
  populated by its owning uid.

I agree with David Herrmann's solution:

  Connections are already limited by the per-user FD limit. So maybe we
  should just allow unlimited connections by the bus UID, too? All other
  connections must be limited, obviously. Otherwise, they can trigger
  slow-paths and reduce performance of the bus considerably.

Signed-off-by: Daniel Mack <daniel@zonque.org>
kdbus-doc: fix policy doc on default behaviour on buses and custom endpoints

Operations are denied by default on default endpoints unless they are
covered by one of the implicit policy rules.

Operations are denied by default on custom endpoints unless the policy
is instructed to allow some exceptions...

The custom endpoint policy if any goes on top of the bus policy.

Signed-off-by: Djalal Harouni <tixxdz@opendz.org>
endpoint: fix kernel doc for kdbus_ep_policy_check_src_names()

Signed-off-by: Djalal Harouni <tixxdz@opendz.org>
connection: broadcast and signaling hide non-fatal errors

Broadcast is one way, we should not care for receivers or their errors.

Currently we may return an error on custom endpoints if the last
receiver is not authorized to see name's of the sender. Even if we
have signaled all previous receivers, if we fail for the last one we may
return an error.

Improve this by just ignoring this type of error. We hide non-fatal
errors, and we return an error only if kdbus_meta_append() fails since
it can not recover. kdbus_meta_append() fails with -ENOMEM, its logic
can perhaps be improved later to have at least a nofail version where we
can recover.

And from D-Bus spec:

"Errors

Messages of type ERROR are most commonly replies to a METHOD_CALL, but
may be returned in reply to any kind of message. The message bus for
example will return an ERROR in reply to a signal emission if the bus
does not have enough memory to send the signal. "

So take this shortcut here, and hide non-fatal errors.

Signed-off-by: Djalal Harouni <tixxdz@opendz.org>
endpoint: check if the endpoint has a policy before locking DB and connection

Littel optimization on kdbus_ep_policy_check_notification().

Default bus endpoints do not enforce the endpoint policy, so instead
of checking if the endpoint is using the policy in
kdbus_ep_policy_check_see_access_unlocked(), just do the check at the
beginning and avoid all the useless locking.

This is already done for kdbus_ep_policy_check_src_names().

Signed-off-by: Djalal Harouni <tixxdz@opendz.org>
doc: policy: specify on which endpoint implicit rules are enforced

Separate implicit rules doc into two parts one for default endpoints and
the other for custom ones.

Signed-off-by: Djalal Harouni <tixxdz@opendz.org>
connection: make kdbus_conn_broadcast() void

As we never return any error from this function anyway, we can as well
make it void.

Signed-off-by: Daniel Mack <daniel@zonque.org>
names: don't refuse unknown flags

We need to allow for forward-compat, so just ignore invalid flags in
kdbus_cmd_name_acquire().

Signed-off-by: Daniel Mack <daniel@zonque.org>
names: simplify code in kdbus_cmd_name_acquire()

There's no need to flush notifications after
kdbus_ep_policy_check_own_access(). Hence, we can get rid of the
jump label.

Signed-off-by: Daniel Mack <daniel@zonque.org>
doc: KDBUS_CMD_NAME_LIST ioctl might fail with -ENOBUFS

KDBUS_CMD_NAME_LIST might fail with -ENOBUFS if there is no available
memory in the connection's pool.

Signed-off-by: Djalal Harouni <tixxdz@opendz.org>
pool: kdbus_pool_slice_alloc() release the pool lock on errors

Signed-off-by: Djalal Harouni <tixxdz@opendz.org>
kdbus.h: implement KDBUS_CMD_{MSG_CANCEL,FREE} with structs (ABI break)

Rather than passing a pointer to a u64 with these ioctls, use a struct.
That also allows us to pass (currently unused) flags around.

Signed-off-by: Daniel Mack <daniel@zonque.org>
handle.c: add kdbus_copy_from_user() helper

Add a little helper to check for 8-byte aligment as well as doing
the actual copy_from_user(). Use it from location where we used to
open-code the same functionality.

Signed-off-by: Daniel Mack <daniel@zonque.org>
test-endpoint: fix nul-termination of string

Found by coverity.

Signed-off-by: Daniel Mack <daniel@zonque.org>
test: fix some 'dead assignment' errors
kdbus.h: add features bitmask to cmd_make and cmd_hello (ABI BREAK)

Add a new field called 'features' to struct kdbus_cmd_make and
kdbus_cmd_hello. In these bitmasks, userspace can request features from
the kernel, and the kernel can itself request features from userspace.

For now, we check that this field is set to 0, and bail with
 -EOPNOTSUPP otherwise.

Signed-off-by: Daniel Mack <daniel@zonque.org>
tree-wide: s/_EP_/_ENDPOINT_/g (API break)

Avoid abbr. and rename EP → ENDPOINT.

Signed-off-by: Daniel Mack <daniel@zonque.org>
metadata: clean up code, and remove invalid comment

Signed-off-by: Daniel Mack <daniel@zonque.org>
handle: use sizeof(*type)

Just a cosmetic change for the sake of consistency.

Signed-off-by: Daniel Mack <daniel@zonque.org>