ws: Don't use getpwnam() directly, not thread-safe

Fixes #479
Reviewed-by: Marius Vollmer <marius.vollmer@redhat.com>
doc: Add documentation for reauthorization scheme

And add documentation for the "authorize" protocol control
messages.

Reviewed-by: Marius Vollmer <marius.vollmer@redhat.com>
reauthorize: Implement pam_reauthorize.so PAM module

This doesn't actually make use of it in Cockpit yet. Includes tests
and various tools to try it out.

The tests require you to do do this (usually after each build):

$ sudo make enable-pam-tests

Otherwise many of them will just be skipped.

We don't use libtool. Building a PAM module doesn't require it. Our
PAM module is (currently) linux specific, and we can build shared
modules there just fine without libtool.

Reviewed-by: Marius Vollmer <marius.vollmer@redhat.com>
ws: Track CockpitWebSocket used credentials per session

Track the credentials we used to start a session on the session object
so we can refer to them later.

Reviewed-by: Marius Vollmer <marius.vollmer@redhat.com>
agent/ws: Send and process "authorize" messages

We now handle reauthorization requests from the pam_reauthorize.so
module, and send that to cockpit-ws for reauthorization.

Reviewed-by: Marius Vollmer <marius.vollmer@redhat.com>
Revert "common: Remove cockpit_log_null_handler"

This reverts commit 177e600e1fd6c8430583fa96bcd5e348752898b1.

Turns out we need this.

Reviewed-by: Marius Vollmer <marius.vollmer@redhat.com>
agent: Implement our own dummy polkit reauthorization agent

cockpit-agent now tells polkit that we're ready to handle
reauthorization requests. Although we don't handle any prompting
in our polkit agent. We rely on pam_reauthorize.so to send us
reauthorize requests via it's back channel instead.

Reviewed-by: Marius Vollmer <marius.vollmer@redhat.com>
web: Implement a basic 'Drop extra privileges' menu option

This tells cockpit-ws not to reauthorize polkit requests any longer.
May need some tweaking in the future, and probably needs to be
timeout driven in addition to this.

Includes the concept of poisoning CockpitCreds objects, so that while
still valid objects, the actual credentials (like password) are no
longer usable.

Reviewed-by: Marius Vollmer <marius.vollmer@redhat.com>
reauthorize: A much simpler reauthorize mechanism

 * We only support a polkit-agent now and the polkit agent reauthorizes
   in its helper using reauthorize_perform().
 * The pam_reauthorize.so module is still around, but it's only use is
   to derive the secret from the login password and put in the keyring.
 * No more listening/connecting to a reauthorization agent.
 * sudo is not covered by this, but the plan is to have a separate
   PAM module which reauthorizes sudo requests against polkit. All
   requests go through polkit.

To enable privileged tests, do:

 $ make enable-root-tests

Fixes #483
Reviewed-by: Marius Vollmer <marius.vollmer@redhat.com>
agent: Fix textstream to return exit-status and exit-signal

These codes weren't being set properly due to an invalid check.

Reviewed-by: Marius Vollmer <marius.vollmer@redhat.com>
Integration tests, distcheck, for reauthorize code

This adds an 'internal' page for testing these sorts of things.
In the long term we don't have to distribute this page as one of
our default modules.

Closes #540
Reviewed-by: Marius Vollmer <marius.vollmer@redhat.com>
Signed-off-by: Marius Vollmer <marius.vollmer@redhat.com>
* Added check-reauthorize to check-verify
tools: Don't bail out if QUnit fails to start in a test

This is usually due to a top level failure loading the javascript
of the test or something like that.

Closes #543
Reviewed-by: Marius Vollmer <marius.vollmer@redhat.com>
web: Fix leave handler of networking page.

Closes #545

Reviewed-by: Stef Walter <stefw@redhat.com>
Use strings as channel identifiers instead of numbers

This is done for three reasons:

 * Much much more flexible going forward, since this is an integral
   part of our protocol, it can never be changed.
 * We can allow routing multiple WebSockets to one agent, without
   trying to coordinate the channel number space of those WebSockets.
   This is not implemented in this patch.
 * We can implement internal channels that don't get routed to a
   WebSocket (necessary for implementing resource loading).

This is an alternative to the signed channel number patch that was
floating around.

Closes #546