CVE-2014-7824: set fd rlimit to 64k for the system dbus-daemon

This ensures that our rlimit is actually high enough to avoid the
denial of service described in CVE-2014-3636 part A.
CVE-2014-7824 has been allocated for this incomplete fix.

Restore the original rlimit for activated services, to avoid
them getting undesired higher limits.

(Thanks to Alban Crequy for various adjustments which have been
included in this commit.)

Bug: https://bugs.freedesktop.org/show_bug.cgi?id=85105
Reviewed-by: Alban Crequy <alban.crequy@collabora.co.uk>
Embargoed security release for Monday
1.8.11
next version number will be 1.8.12
Set error when message delivery is denied due to receive rule

This makes bus_context_check_security_policy follow convention of
setting errors if function indicates failure and has error parameter.
Notable implication is that AccessDenied error will be sent if sending message
to addressed recipient is denied due to receive rule. Previously, message
was silently dropped.

This also fixes assertion failure when message is denied at addressed recipient
while sending pending auto activation messages.

Bug: https://bugs.freedesktop.org/show_bug.cgi?id=86194
NEWS
README, HACKING: add some brief notes on reporting security vulnerabilities

We now have a private mailing list that can be the security contact.
Log to syslog when auth_timeout drops an incomplete connection

This is a symptom of either a denial of service attack, or a
serious performance problem. Either way, sysadmins should know.

Bug: https://bugs.freedesktop.org/show_bug.cgi?id=86431
Revert "config: change default auth_timeout to 5 seconds"

This reverts commit 54d26df52b6a394bea175651d1d7ad2ab3f87dea.

It appears this change may cause intermittent slow or failed boot,
more commonly on slower/older machines, in at least Mageia and
possibly also Debian. This would indicate that while the system
is under load, system services are not completing authentication
within 5 seconds.

This change was not the main part of fixing CVE-2014-3639, but does
help to mitigate that attack. As such, increasing this timeout makes
the denial of service attack described by CVE-2014-3639 somewhat
more effective: a local user connecting to the system bus repeatedly
from many parallel processes can cause other users' attempts to
connect to take longer.

If your machine boots reliably with the shorter timeout, and
resilience against local denial of service attacks is important
to you, putting this in /etc/dbus-1/system-local.conf
or a file matching /etc/dbus-1/system.d/*.conf can restore
the lower limit:

    <busconfig>
      <limit name="auth_timeout">5000</limit>
    </busconfig>

Bug: https://bugs.freedesktop.org/show_bug.cgi?id=86431
1.8.12
1.8.13