doc: document the new broadcast behaviour

Currently we do not check senders when doing broadcasts.

In order to block the following scenarios, we need to improve the
broadcast logic and check the policy rules before allowing broadcast
messages.

* Since unprivileged users can't use unicast to communicate unless a
  policy that permits this was uploaded, follow and block broadcast
  communications between unprivileged users unless a policy rule that
  allows this is satisfied.

* We do not want unprivileged connections that do not own names to
  send signals to privileged connections.

* We do not want unprivileged connections that do not own names to
  send signals to other connections that might own names.

So to achieve this and to allow broadcast messages for legitimate
scenarios, we follow the same unicast checks, and we introduce one
implicit rule to allow broadcast from connections that own names.

1) Check custom endpoint policies, if it allows the TALK continue,
otherwise block.

2) If the sender connection is a privileged connection, allow broadcast.

3) If the sender and receiver run under the same user, allow broadcast.

4) If the sender connection owns names on the bus and if the
   destination connection do not own names, allow broadcast.
   Otherwise check bus policy rules for these two reasons:

   * anonymous connections should not signal to other connections.
   * receivers that own names may have policies that block the TALK
     access, so do not bypass this.

   This openes the case where connections that own names may gain TALK
   access to other connections on the bus through broadcast! Yes but
   since this is the intended behaviour of signals we can't do
   otherwise. Of course as stated above if the destination owns names
   then broadcasts are subject to policy rules (we do not bypass policy
   rules).

5) If the policy rules of the default endpoint block the TALK access,
then block broadcasts, otherwise allow it.

These are the same rules that apply to TALK access and unicast checks,
the only exception is rule 4) that was instroduced to allow services to
signal on the bus.

Signed-off-by: Djalal Harouni <tixxdz@opendz.org>
test: test-policy-priv do broadcast tests before a policy holder is uploaded

Add broadcast tests, and modify RUN_UNPRIVILEGED() so we can specify
the uid/gid of the user to drop in and run tests.

Move all the tests that check the default behaviour of the bus and
before a policy holder is uploaded to their function:
test_priv_before_policy_upload().

Each test is documented.

Signed-off-by: Djalal Harouni <tixxdz@opendz.org>
test: test-policy-priv do broadcast tests after a policy holder is uploaded

Add more broadcast tests that will run after a policy holder is uploaded
on the bus.

Each test is documented. Currently we fail at these tests, next patches
will fix this.

Signed-off-by: Djalal Harouni <tixxdz@opendz.org>
connection: make conn->name_count atomic

Make conn->name_count an atomic type, so it can be checked safely later
when checking that the connection does really own names.

While we are it fix another count bug in kdbus_cmd_name_acquire() now we
register a slot by increment the counter before all operations, and we
decrement it before returning, this way we do not race for names and no
need to use complex locks.

Signed-off-by: Djalal Harouni <tixxdz@opendz.org>
broadcast: add TALK access checks for broadcast messages

Add code to perform broadcast access checks, we split the shared code
into two functions:
kdbus_custom_ep_check_talk_access()
kdbus_ep_has_default_talk_access()

And add kdbus_ep_policy_check_broadcast() to do the broadcast access
checks.

To perform broadcast, these rules must be satisfied:

1) Check custom endpoint policies, if it allows the TALK continue,
   otherwise block.

2) If the sender connection is a privileged connection, allow
broadcast.

3) If the sender and receiver run under the same user, allow broadcast.

4) If the sender connection owns names on the bus and if
the destination connection do not own names, allow broadcast. Otherwise
fail check the bus policy rules for these two reasons:

   * anonymous connections should not signal to other connections.
   * receivers that own names may have policies that block the TALK
     access, so do not bypass this.

  This openes the case where connections that own names may gain TALK
  access to other connections on the bus through broadcast! Yes but
  since this is the intended behaviour of signals we can't do
  otherwise. Of course as stated above if the destination owns names
  then broadcasts are subject to policy rules (we do not bypass policy
  rules).

5) If the policy rules of the default endpoint block the TALK access,
then block broadcasts, otherwise allow it.

These are the same rules that apply to TALK access and unicast checks,
the only exception is rule 4) that was introduced to allow services to
signal on the bus.

Signed-off-by: Djalal Harouni <tixxdz@opendz.org>
endpoint: add function kdbus_ep_policy_check_see_access() and use it

Add the locked version of kdbus_ep_policy_check_see_access_unlocked()
and use it where appropriate.

Signed-off-by: Djalal Harouni <tixxdz@opendz.org>
names: on KDBUS_CMD_NAME_RELEASE check that connection can see the name

Before trying to release a name verify that the connection is able to
see the name on the endpoint, we do this since custom endpoint may
install policies to restrict SEE access if we do not perform this check,
then a connection may try KDBUS_CMD_NAME_RELEASE ioctl() and brute force
names owned by other connections, in this case it will get the
-EADDRINUSE error which indicates that the name is in use, later it can
monitor the name by re-trying the call, this way it can bypass the
notification checks that are done for
{KDBUS_ITEM_NAME_ADD|KDBUS_ITEM_NAME_REMOVE}.

The kdbus_ep_policy_check_notification() checks first if the connection
is able to see the notifications. So follow and don't leak hints from
KDBUS_CMD_NAME_RELEASE.

No need to check for OWN access, since for other connections as stated
above a name will fail with -EADDRINUSE.

Signed-off-by: Djalal Harouni <tixxdz@opendz.org>
Merge branch 'master' of https://code.google.com/p/d-bus
handle: do not look at 'features' for now

We still need to decide how we wanna handle this.

Signed-off-by: Daniel Mack <daniel@zonque.org>