kdbus.h: add features bitmask to cmd_make and cmd_hello (ABI BREAK)

Add a new field called 'features' to struct kdbus_cmd_make and
kdbus_cmd_hello. In these bitmasks, userspace can request features from
the kernel, and the kernel can itself request features from userspace.

For now, we check that this field is set to 0, and bail with
 -EOPNOTSUPP otherwise.

Signed-off-by: Daniel Mack <daniel@zonque.org>
tree-wide: s/_EP_/_ENDPOINT_/g (API break)

Avoid abbr. and rename EP → ENDPOINT.

Signed-off-by: Daniel Mack <daniel@zonque.org>
metadata: clean up code, and remove invalid comment

Signed-off-by: Daniel Mack <daniel@zonque.org>
handle: use sizeof(*type)

Just a cosmetic change for the sake of consistency.

Signed-off-by: Daniel Mack <daniel@zonque.org>
test: print filename in assertion

Signed-off-by: Daniel Mack <daniel@zonque.org>
tree-wide: reject unknown flags

After further discussion, we concluded that we need to be strict on
the checking of flags and reject everything that we don't know.

If we eventually need more flags, we have to deal with feature
negotiation.

Signed-off-by: Daniel Mack <daniel@zonque.org>
metadata: add kdbus_meta_dup()

Add a way to duplicate a metadata object. This will be needed to dup
conn->owner_meta and attach that to messages, instead of new items
retrieved from 'current'.

Signed-off-by: Daniel Mack <daniel@zonque.org>
connection: suppress message metadata attachment for faked creds

If a connection has installed faked credentials upon its creation, alter
the message treatment so that

 a) the kmsg's metadata is not a freshly allocated one but a full copy
    of the source connection's owner_meta

 b) no new items are attached to that metadata object

The problem here is that when a privileged bus user provided fake
credentials, it did that because it wants to be a proxy for another
task. In this case, 'current' would point us to the information of
the proxy's task, not the proxied one. As we don't want to provide
receivers with wrong information, make sure the only metadata items
that are added to messages are those which we have in faked form
already.

Signed-off-by: Daniel Mack <daniel@zonque.org>
TODO: update
kdbus.txt: more information about faked credentials and metadata attachment

Signed-off-by: Daniel Mack <daniel@zonque.org>
message: allow both names and unique IDs at the same time

Do not bail if a name item is passed while the message is addressed to
a unique ID. We'll use that message configuration in the next patch.

Signed-off-by: Daniel Mack <daniel@zonque.org>
connection: check for msg->dst_id == name_entry->conn->id

When sending a message, we now allow both the ID and the name to be
specified. In such cases, make sure to reject the message if the
connection that currently owns the name does not match the given ID.

This allows us to tie the action of sending a message to the fact that
the connection still owns a certain name, which is essential for
enforcing a policy from userspace (bus-proxyd) in a race-free way.

Signed-off-by: Daniel Mack <daniel@zonque.org>
connection: style nit

Signed-off-by: Daniel Mack <daniel@zonque.org>
test: fix typo

fix typo in bybye test description
connection: attach KDBUS_ATTACH_NAMES | KDBUS_ATTACH_CONN_NAME to faked creds

If the source connection has faked credentials, the metadata object
associated with the kmsg may still be augmented by KDBUS_ATTACH_NAMES
and KDBUS_ATTACH_CONN_NAME.

Signed-off-by: Daniel Mack <daniel@zonque.org>
doc: document the new broadcast behaviour

Currently we do not check senders when doing broadcasts.

In order to block the following scenarios, we need to improve the
broadcast logic and check the policy rules before allowing broadcast
messages.

* Since unprivileged users can't use unicast to communicate unless a
  policy that permits this was uploaded, follow and block broadcast
  communications between unprivileged users unless a policy rule that
  allows this is satisfied.

* We do not want unprivileged connections that do not own names to
  send signals to privileged connections.

* We do not want unprivileged connections that do not own names to
  send signals to other connections that might own names.

So to achieve this and to allow broadcast messages for legitimate
scenarios, we follow the same unicast checks, and we introduce one
implicit rule to allow broadcast from connections that own names.

1) Check custom endpoint policies, if it allows the TALK continue,
otherwise block.

2) If the sender connection is a privileged connection, allow broadcast.

3) If the sender and receiver run under the same user, allow broadcast.

4) If the sender connection owns names on the bus and if the
   destination connection do not own names, allow broadcast.
   Otherwise check bus policy rules for these two reasons:

   * anonymous connections should not signal to other connections.
   * receivers that own names may have policies that block the TALK
     access, so do not bypass this.

   This openes the case where connections that own names may gain TALK
   access to other connections on the bus through broadcast! Yes but
   since this is the intended behaviour of signals we can't do
   otherwise. Of course as stated above if the destination owns names
   then broadcasts are subject to policy rules (we do not bypass policy
   rules).

5) If the policy rules of the default endpoint block the TALK access,
then block broadcasts, otherwise allow it.

These are the same rules that apply to TALK access and unicast checks,
the only exception is rule 4) that was instroduced to allow services to
signal on the bus.

Signed-off-by: Djalal Harouni <tixxdz@opendz.org>
test: test-policy-priv do broadcast tests before a policy holder is uploaded

Add broadcast tests, and modify RUN_UNPRIVILEGED() so we can specify
the uid/gid of the user to drop in and run tests.

Move all the tests that check the default behaviour of the bus and
before a policy holder is uploaded to their function:
test_priv_before_policy_upload().

Each test is documented.

Signed-off-by: Djalal Harouni <tixxdz@opendz.org>
test: test-policy-priv do broadcast tests after a policy holder is uploaded

Add more broadcast tests that will run after a policy holder is uploaded
on the bus.

Each test is documented. Currently we fail at these tests, next patches
will fix this.

Signed-off-by: Djalal Harouni <tixxdz@opendz.org>
connection: make conn->name_count atomic

Make conn->name_count an atomic type, so it can be checked safely later
when checking that the connection does really own names.

While we are it fix another count bug in kdbus_cmd_name_acquire() now we
register a slot by increment the counter before all operations, and we
decrement it before returning, this way we do not race for names and no
need to use complex locks.

Signed-off-by: Djalal Harouni <tixxdz@opendz.org>
broadcast: add TALK access checks for broadcast messages

Add code to perform broadcast access checks, we split the shared code
into two functions:
kdbus_custom_ep_check_talk_access()
kdbus_ep_has_default_talk_access()

And add kdbus_ep_policy_check_broadcast() to do the broadcast access
checks.

To perform broadcast, these rules must be satisfied:

1) Check custom endpoint policies, if it allows the TALK continue,
   otherwise block.

2) If the sender connection is a privileged connection, allow
broadcast.

3) If the sender and receiver run under the same user, allow broadcast.

4) If the sender connection owns names on the bus and if
the destination connection do not own names, allow broadcast. Otherwise
fail check the bus policy rules for these two reasons:

   * anonymous connections should not signal to other connections.
   * receivers that own names may have policies that block the TALK
     access, so do not bypass this.

  This openes the case where connections that own names may gain TALK
  access to other connections on the bus through broadcast! Yes but
  since this is the intended behaviour of signals we can't do
  otherwise. Of course as stated above if the destination owns names
  then broadcasts are subject to policy rules (we do not bypass policy
  rules).

5) If the policy rules of the default endpoint block the TALK access,
then block broadcasts, otherwise allow it.

These are the same rules that apply to TALK access and unicast checks,
the only exception is rule 4) that was introduced to allow services to
signal on the bus.

Signed-off-by: Djalal Harouni <tixxdz@opendz.org>