connection: kdbus_ep_policy_check_own_access() -> kdbus_conn_policy_own_name()

The OWN access check is not a property of an endpoint, but of a
connection. Move the function to connection.c and drop the "endpoint"
argument.

Furthermore, prepare for further renamed and use the common
kdbus_conn_policy() prefix.

Signed-off-by: David Herrmann <dh.herrmann@gmail.com>
connection: kdbus_conn_kmsg_send() -> kdbus_cmd_msg_send()

The _kmsg_send() function is no longer used for non-ioctl messages, so we
can mark it as command dispatcher now, like all the other kdbus_cmd_msg_*
helpers we already have.

This also allows us to drop the "ep" argument, as we can safely use
conn_src->ep now.

Signed-off-by: David Herrmann <dh.herrmann@gmail.com>
connection: drop superfluous argument to kdbus_conn_check_access()

The endpoint is always the endpoint of the source connection. Drop it and
re-order arguments to more reflect the functions nature.

Signed-off-by: David Herrmann <dh.herrmann@gmail.com>
connection: kdbus_ep_policy_check_talk_access() -> kdbus_conn_policy_talk()

Same as for kdbus_conn_policy_own_name(), move the policy helper where it
belongs. Also drop the 'ep' argument as it is redundant.

Signed-off-by: David Herrmann <dh.herrmann@gmail.com>
connection: kdbus_ep_policy_check_see_access* -> kdbus_conn_policy_see_name()

Same as the other policy helpers, move SEE verification to connection.c
and drop the endpoint argument. It's always implicitly given via the
connection.

Also follow the easier naming style that does not clash with policy.c.

Signed-off-by: David Herrmann <dh.herrmann@gmail.com>
connection: dont lock subjects on SEE policy check

There is no need to lock the source connection when checking SEE policies.
The only reason connection locks are needed is if we iterate the target
names. We never do that during simple SEE policy checks (but only during
full target connection SEE checks), so drop that lock.

Signed-off-by: David Herrmann <dh.herrmann@gmail.com>
connection: kdbus_ep_policy_check_src_names() -> kdbus_conn_policy_see()

Same as the previous policy helpers, move SRC-NAME verification to
connection.c. Furthermore, rename the function to a subject-based name:
  kdbus_conn_policy_see(conn, whom)
It now verifies whether @conn can see @whom, which is what we really want
to know. The fact that this relies on the destination names is irrelevant
for the call-side. Policy is based on SEE policies, so let it look like it
really is.

This again allows us to drop the 'ep' argument as it is implicitly given
by the subject 'conn'.

Signed-off-by: David Herrmann <dh.herrmann@gmail.com>
connection: re-write notification policy

Rewrite the notification policy check and add justifications why the
different types are dropped. Also add proper WARN()s instead of silently
rejecting invalid callers.

Signed-off-by: David Herrmann <dh.herrmann@gmail.com>
policy: speed-up and simplify query helpers

Instead of hard-coding each policy-db query type, this commit provides
kdbus_policy_query() and kdbus_policy_query_unlocked(). So far, they're
only used for SEE and OWN, but TALK can also be converted.

The policy DB is seen as generic entity from the outside, so we should
push any non-policy decisions into it. The authority on the policy
application is the bus, the endpoint or the connection, so keep it there.

Furthermore, we now pass the name-hash into the function, so we don't have
to hash multiple times if we query multiple DBs like with custom
endpoints.

Signed-off-by: David Herrmann <dh.herrmann@gmail.com>
connection: drop unused includes/declarations

Drop the dead kdbus_conn_namespace_eq() declaration and any namespace
includes. Add them to metadata.c where they're actually used.

Signed-off-by: David Herrmann <dh.herrmann@gmail.com>
purge: drop talk cache

Once we use current->creds as policy credentials for UNICASTS, and
file->f_creds for receiver-based policy checks, we cannot use the cache as
we have it now. The creds may change at any time and it's not clear which
creds were used for a given policy check.

Furthermore, the current cache is highly inefficient. It uses only 64
buckets for the whole bus cache. It needs exclusive locking for lookups
and requires _full_ cache traversals whenever a name changes ownership, a
connection dies or a policy is changed.

Drop the cache for now.

Once our code is considered ready and we do benchmarking, we can re-add
it. However, I really think it should look more like this:

    Each *connection* has a policy-cache. This caches the results of the
    respective kdbus_policy_query() calls so we can skip calling into the
    policy (and thus skip locking the policy/bus) on cache hits. On cache
    misses, we call into the policy and cache the result with a back-link
    to the policy-entry that produced this result. Whenever the policy-db
    changes, it drops all cache entries that were generated by a given
    policy-entry.

    As a bonus, our cache can be based on conn->lock. There is no need to
    lock all caches. Furthermore, the policy-db can be updated to use RCU
    as policy-db modifications are definitely not considered a fast-path.
    We then can synchronize on policy-updates and get a lock-free policy
    db.

Anyway, unless someone does some benchmarking, it seems rather useless to
create policy-caches. Lets drop it for now, get everything in place
underneath and re-add it later, if needed (and yeah, chances are high that
some sort of optimization is needed).

Signed-off-by: David Herrmann <dh.herrmann@gmail.com>
policy: drop kdbus_policy_check_talk_access()

This helper is now redundant. We already have the same iterator in
connection.c. Move it into its own function and then drop the
policy-helper.

Signed-off-by: David Herrmann <dh.herrmann@gmail.com>
names: skip policy-check on NAME_RELEASE

If user-space requests to release a name, we *must* grant that. Otherwise,
a policy-change after the name was acquired might prevent the user from
releasing it.

Furthermore, there really is no reason to check policy to release
_acquire_ resources. So drop that.

However, make sure to return ESRCH regardless whether the name is un-owned
or owned by someone else. We must not leak information about a name in
case the caller cannot see it. Furthermore, it's really not our business
to return information on a name when someone tries to release it. The
information that they don't own this resource should be more than enough.
I'd be even inclined to return "0" in those cases...

Signed-off-by: David Herrmann <dh.herrmann@gmail.com>
names: fix coding-style

Don't split lines needlessly. If we drop the q_ prefix, we can properly
get the whole foreach statement into one line.

Signed-off-by: David Herrmann <dh.herrmann@gmail.com>
connection: return 'bool' for policy decisions

It's rather weird to generate 'int' as result for a policy query. Such
queries must never fail for any reason but EPERM, so lets hard-code that
behavior and return 'bool'.

In case we ever re-add a cache, we *must* not make any cache-creation
errors fatal. Instead, we should simply skip caching and still return the
correct policy decision.

This is really important, because deep down in the policy-db we cannot
make any reasonable choice on error codes. For instance, we now return
ENOENT for some policy-decisions in case we don't want to leak information
to custom endpoints that cannot see the peer. However, we actually return
ESRCH in we cannot find a name later. This is really hard to track down
because both errors are generated in totally different code locations.

This commit does not fix those, it only turns the 'int' into a 'bool'.
Follow-ups will fix the error-code mess.

Signed-off-by: David Herrmann <dh.herrmann@gmail.com>
connection: fix information leak on !SEE for real

In the past we noticed that if you cannot SEE a name, we should not return
EPERM but ENOENT. Otherwise, you will notice the name exists in case the
policy-check is done _after_ looking up the name.

For NAME queries we're fine, but for ID queries we're not. Lets fix this
all at once and make both lookup and policy-check use the same code-path,
and thus the same error-code.

Also add tests to verify both error codes are always the same. There is no
reason to let user-space know "you're allowed to see that name but it
doesn't exist". Stop that crazy and just return the same error regardless
whether you cannot see it or whether it doesn't exist.

Signed-off-by: David Herrmann <dh.herrmann@gmail.com>
policy: return highest policy on kdbus_policy_query()

Instead of asking for a specific policy level, we now always return the
highest level found. That means, kdbus_policy_query() always searches
through all access-entries of a given name-entry and tries to find the
highest access-level that matches.

Note that this means we cannot shortcut the policy-check on a single name.
However, that should not affect the performance considerably. But the
upside is we now can properly cache any result of the policy-db. There is
no reason to limit it to TALK. Instead, a policy cache can properly take
the policy result and just cache it, regardless of the call-side.

Signed-off-by: David Herrmann <dh.herrmann@gmail.com>
policy: drop unused kdbus_policy_check_access()

Inline this helper into kdbus_policy_query_unlocked(). No reason to split
both. The query helper is a one-liner and the only caller of
check_access().

Signed-off-by: David Herrmann <dh.herrmann@gmail.com>
policy: drop unused 'wildcard' parameter

This argument is unused, drop it from kdbus_policy_lookup().

Signed-off-by: David Herrmann <dh.herrmann@gmail.com>
util: kdbus_str_hash() -> kdbus_strhash()

Lets make this function look more like strlen(), strcopy(), ... and
friends. Not that I like it in particular, but a followup will introduce
kdbus_strnhash() and those names get really weird once used with
underscore style.

Signed-off-by: David Herrmann <dh.herrmann@gmail.com>