ws: Add SELinux policy for cockpit-ws to our test environment

Reviewed-by: Marius Vollmer <marius.vollmer@redhat.com>
test: Turn on selinux enforcing in our tests

Reviewed-by: Marius Vollmer <marius.vollmer@redhat.com>
test: Create test images with SELinux enabled and enforcing

We run in enforcing mode when not in maintain mode of running
our VMs

Reviewed-by: Marius Vollmer <marius.vollmer@redhat.com>
test: Pull audit messages and check that not unexpected

Reviewed-by: Marius Vollmer <marius.vollmer@redhat.com>
test: Ignore another journal message

Reviewed-by: Marius Vollmer <marius.vollmer@redhat.com>
ws: Implement a new selinux policy for cockpit-ws and cockpit-session

 * cockpit-ws is the most restricted process
   - listens on the network
   - runs cockpit-session
   - connects to other hosts via ssh
   - reads some files in specific directories
   - not much else
 * cockpit-session is slightly restricted
   - but it runs a full PAM stack
   - transitions to user/group
   - runs cockpit-agent
 * cockpit-agent is totally unconfined
   - runs as the user

Reviewed-by: Marius Vollmer <marius.vollmer@redhat.com>
ws: Add selinux unconfined policy for test-server

Fixes #200
Reviewed-by: Marius Vollmer <marius.vollmer@redhat.com>
ws: Some cleanup in the selinux type enforce file

Reviewed-by: Marius Vollmer <marius.vollmer@redhat.com>
test: Enable globbing in the INSTALL script.

Because we need it for "rm -rf /var/log/journal/*".  This was broken
all the time but now it bites us because audit messages from
before the relabeling are left in the journal.

Reviewed-by: Stef Walter <stefw@redhat.com>
test: Enable audit journalling in cockpit.setup.

And not in the INSTALL script.  This avoids disturbing other image
flavors.

Reviewed-by: Stef Walter <stefw@redhat.com>
ws: Rely on pam_selinux.so to transition cockpit-agent correctly

Changes from mgrepl@redhat.com
Reviewed-by: Marius Vollmer <marius.vollmer@redhat.com>
ws: Cleanup selinux policy further

Use common interfaces instead of defining the policy bit by byt

Signed-off-by: Stef Walter <stefw@redhat.com>
 * userdomain_signal -> userdom_signal_all_users
 * Cleaned up comments
 * added setexec for cockpit_session_t
test: Make selinux permissive in the ipa test image

We really don't want to be chasing around selinux bugs in a
whole different stack ... at least not yet.

Reviewed-by: Marius Vollmer <marius.vollmer@redhat.com>
test: Don't check the error message when killing the agent.

It doesn't seem to be predictable any more.
See https://github.com/cockpit-project/cockpit/issues/606
ws: cockpit.socket should be able to listen on reserved ports

Update the SELinux policy.

Closes #609
Reviewed-by: Marius Vollmer <marius.vollmer@redhat.com>
web: Fix jumping of container image names

Closes #603
Reviewed-by: Marius Vollmer <marius.vollmer@redhat.com>
web: Associate cgroups for geard containers correctly

This is a temporary work around until we start showing resources
for systemd services rather than docker containers.

Closes #604
Reviewed-by: Marius Vollmer <marius.vollmer@redhat.com>
ws: Fix logout, disconnect, refresh logic

First of all decouple the object references of CockpitWebService
from the logged in state. We don't want an erroneous ref leak to
become a security issue.

After the last WebSocket disconnects we wait for 15 seconds before
discarding the credentials. This allows refreshes to work, and is
exactly the same logic for holding the credentials between /login
and the first WebSocket connecting.

Using "Log out" (ie: /logout) still works as expected and discards
credentials and login state immediately, disconnecting all
WebSockets and so on.

Closes #608
Reviewed-by: Marius Vollmer <marius.vollmer@redhat.com>
Fix setuid by setting %attr on cockpit-polkit

Upstream bug URL: https://bugzilla.redhat.com/show_bug.cgi?id=117858