kdbus.h: explicitly document that some fields cannot be trusted
handle,bus: when caching credential data includs new PIDS item in it

(also, make sure we add the AUXGROUPS item to both cases, too)

Signed-off-by: Lennart Poettering <lennart@poettering.net>
test: fix tests to run with new _PIDS items

Signed-off-by: David Herrmann <dh.herrmann@gmail.com>
metadata: use from_kuid() rather than from_kuid_munged() when translating audit loginuid

This is necessary since the audit loginuid might be assigned regularly
-1, and we should not convert that to something weird. Note that /proc
uses the non-munged conversion too, hence that looks appropriate here,
too.

Signed-off-by: Lennart Poettering <lennart@poettering.net>
bus: make broadcasts subject to TALK policy

A connection A receives broadcasts from connection B if A has TALK access
to B. Sending a broadcast is not a privileged operation, so everyone is
allowed to do that. The question always is "who receives the broadcast".
There we require TALK access of the _receiver_.

This makes broadcasts similar to method-replies, except that you install
MATCH rules instead of shooting temporary wholes by sending method calls.

Signed-off-by: David Herrmann <dh.herrmann@gmail.com>
limits: increase connections-per-uid and names-per-connection limits

Let's avoid problems with settings that are too low for real-life, as
discussed on the D-Bus ML:

http://lists.freedesktop.org/archives/dbus/2014-November/016433.html

Signed-off-by: Lennart Poettering <lennart@poettering.net>
handle: rework privileged connection logic

Make sure CAP_IPC_OWNER is checked on the user-namespace of the domain,
not the init-user-namespace. We bind domains to a given user-namespace so
we're safe.

Furthermore, make sure connections via custom endpoints are _never_
privileged. They don't act with their own user-id but always on an
anonymous user.

Signed-off-by: David Herrmann <dh.herrmann@gmail.com>
connection: return msg-size in CMD_RECV (ABI break)

An activator usually does not want to map the whole 16MB pool as it never
looks at more than the first connection. Therefore, return the msg-size in
CMD_RECV in combination with the pool offset. This way, the activator can
mmap() just the part it's interested in, use it to log some metadata about
the activation request, unmap it again and start the implementor.

Signed-off-by: David Herrmann <dh.herrmann@gmail.com>
docs: some random doc updates

Signed-off-by: David Herrmann <dh.herrmann@gmail.com>
handle: allow activators to receive messages

We want activators to be able to use KDBUS_CMD_MSG_RECV with
KDBUS_RECV_PEEK, so allow it. While at it, allow any kind of flags on
KDBUS_CMD_MSG_RECV. Activators are privileged, so there's no reason to
deny it.

Signed-off-by: David Herrmann <dh.herrmann@gmail.com>
metadata: rework for receiver translation

In order to support per-recipient namespace translations, buffers
must be allocated and filled only when we know for which connection
we have to translate. For this, rework the metadata implementation:

* Instead of having a metadata object that carries a blob of data
  which grows over time when more items are attached, only store the
  kernel view of resources internally and don't magically translate
  anything in other namespaces at the time of gathering information.

* In order to get the recipient's view of translated information,
  provide a function called kdbus_meta_export() that returns an
  allocated buffer that can be written to the recipient pool.
  The metadata object is not touched by this operation, hence
  it can be re-used mutliple times.

* Make kdbus_meta ref-counted, so kmsg->meta can take a reference to
  conn_src->owner_meta

* Add a function to fill the database with items from structs, called
  kdbus_meta_fake(). The only use case are connection that provide
  faked credentials at HELLO time. Once this function was called, a
  subsequent kdbus_meta_collect() will be a no-op.

Also, the namespaces are no longer pinned in the domain now, but
in the connection, at the time when the HELLO ioctl is called.

Another reference to the current user_ns is taken in the metadata
object itself, so we can compare namespaces and drop CAPS items if
they differ.

Signed-off-by: Daniel <daniel@zonque.org>
handle: properly copy msg_size over to user-space

Make sure to copy msg_size to user-space so they can actually make use of
it. Also document that this msg_size field is *not* redundant. It is
always bigger than msg->size, as it also accounts for all appended data.

Signed-off-by: David Herrmann <dh.herrmann@gmail.com>
util: drop kdbus_offset_set_user()

We now have a more generic kdbus_member_set_user(). Use it!

Signed-off-by: David Herrmann <dh.herrmann@gmail.com>
metadata: fix SECLABEL if no security module is loaded

Restore the previous EOPNOTSUPP fix to ignore SECLABEL if no security
module is loaded.

Signed-off-by: David Herrmann <dh.herrmann@gmail.com>
bus: fix error-path memleak on meta_export()

We have to free the new buffer in our error-paths, otherwise we leak the
allocated metadata buffer.

Signed-off-by: David Herrmann <dh.herrmann@gmail.com>
Changelog: update

Signed-off-by: Daniel Mack <daniel@zonque.org>
metadata: handle EXE with chroot/mnt-ns

A process can change its root path to any arbitrary value, using chroot or
mnt-namespaces. Therefore, we need to make sure to correctly translate EXE
paths to the target process.

We'd require access to something like __d_path() to do that, but
unfortunately, it is not exported to modules. For now, drop EXE if the
root path differs between connection and target process. If they match,
use d_path().

Signed-off-by: David Herrmann <dh.herrmann@gmail.com>
item.h: move back KDBUS_ITEM_* helpers

Signed-off-by: Daniel Mack <daniel@zonque.org>
metadata: remove typo

Signed-off-by: Daniel Mack <daniel@zonque.org>
bus: fix metadata sanity check

No need to return -EPERM if there is no metadata.

Signed-off-by: Daniel Mack <daniel@zonque.org>