test: Allow phantomjs to be in $PATH

For example phantomjs may be installed in your homedir. It should
still be in the path, but not necessarily in /usr/bin

Closes #1227
Reviewed-by: Marius Vollmer <marius.vollmer@redhat.com>
selinux: session PAM stack wants to communicate with systemd via socket

Symptom:

audit: type=1400 audit(1411115120.035:21): avc:  denied  { sendto } for  pid=1176
	comm="cockpit-session" path="socket:[18680]" dev="sockfs" ino=18680
	scontext=system_u:system_r:cockpit_session_t:s0
	tcontext=system_u:system_r:init_t:s0 tclass=unix_stream_socket
	permissive=0

Closes #1224
Reviewed-by: Marius Vollmer <marius.vollmer@redhat.com>
session: Make sure our auth file descriptor gets closed on exec

We never want the auth file descriptor to leak to the unpriveleged
cockpit-agent. Although we close all extra file descriptors before
execing(), this is a double insurance against future refactoring.

Closes #1225
Reviewed-by: Marius Vollmer <marius.vollmer@redhat.com>
shell: Rules for overflow of user account boxes.

Fixes #1211
Closes #1231
Reviewed-by: Marius Vollmer <marius.vollmer@redhat.com>
shell: Move find_logical_volume_block to file scope

Reviewed-by: Stef Walter <stefw@redhat.com>
shell, daemon: Optionally resize filesystem together with logical volume

And provide a good default.

Fixes #1129
Reviewed-by: Stef Walter <stefw@redhat.com>
test: Depend on storaged 0.3.1

For the 'resize_fsys' option.

Reviewed-by: Stef Walter <stefw@redhat.com>
test: Enable updates-testing for mock

Reviewed-by: Stef Walter <stefw@redhat.com>
test: Check resizing of mounted filesystems

Closes #1173
Reviewed-by: Stef Walter <stefw@redhat.com>
daemon: Allow "wheel" to change hostnames

By allowing interactive authentication when talking to hostnamed.

Closes #1201
Reviewed-by: Stef Walter <stefw@redhat.com>
configure: Link appropriate binaries to krb5 libraries

Reviewed-by: Marius Vollmer <marius.vollmer@redhat.com>
common: Utility function for decoding hex strings

And tests

Reviewed-by: Marius Vollmer <marius.vollmer@redhat.com>
ws: Implement basic GSSAPI kerberos authentication

The actual authentication happens in cockpit-session, which has
access to the keytab

Reviewed-by: Marius Vollmer <marius.vollmer@redhat.com>
ws: Implement basic testing of kerberos auth during 'make check'

This requires the 'krb5-server' package or similar to be installed
while running 'make check'

Reviewed-by: Marius Vollmer <marius.vollmer@redhat.com>
static: Try an SSO login before showing the login form

This allows kerberos (ie: Negotiate, GSSAPI) SSO authentication to
happen before showing a login form.

Fixes #57
Reviewed-by: Marius Vollmer <marius.vollmer@redhat.com>
static: Don't use single sign-in if user explicitly logged out

When the user explicitly logged out, don't try and use single
sign in to authenticate. Otherwise the user would just be logged
in again.

There are two use cases here:

 * The user wants to finish the session and log out
 * The user wants to log in as someone else

So we force display of the login form in the case where logout
was explicitly used.

Reviewed-by: Marius Vollmer <marius.vollmer@redhat.com>
ws: Send WWW-Authenticate: Negotiate header for any auth failure

Reviewed-by: Marius Vollmer <marius.vollmer@redhat.com>
ws: Test kerberos against host@COCKPIT keytab credentials

This is how it is used with Active Directory, and not necessarily
with HTTP specific kerberos SPN.

Reviewed-by: Marius Vollmer <marius.vollmer@redhat.com>
ws: If we can't resolve a real local name, use fully qualified

Use fully qualified kerberos user name if we cannot resolve it
into a valid local user via the kerberos routines.

Reviewed-by: Marius Vollmer <marius.vollmer@redhat.com>
test: Check negotiate authentication

Reviewed-by: Marius Vollmer <marius.vollmer@redhat.com>