names: skip policy-check on NAME_RELEASE

If user-space requests to release a name, we *must* grant that. Otherwise,
a policy-change after the name was acquired might prevent the user from
releasing it.

Furthermore, there really is no reason to check policy to release
_acquire_ resources. So drop that.

However, make sure to return ESRCH regardless whether the name is un-owned
or owned by someone else. We must not leak information about a name in
case the caller cannot see it. Furthermore, it's really not our business
to return information on a name when someone tries to release it. The
information that they don't own this resource should be more than enough.
I'd be even inclined to return "0" in those cases...

Signed-off-by: David Herrmann <dh.herrmann@gmail.com>
names: fix coding-style

Don't split lines needlessly. If we drop the q_ prefix, we can properly
get the whole foreach statement into one line.

Signed-off-by: David Herrmann <dh.herrmann@gmail.com>
connection: return 'bool' for policy decisions

It's rather weird to generate 'int' as result for a policy query. Such
queries must never fail for any reason but EPERM, so lets hard-code that
behavior and return 'bool'.

In case we ever re-add a cache, we *must* not make any cache-creation
errors fatal. Instead, we should simply skip caching and still return the
correct policy decision.

This is really important, because deep down in the policy-db we cannot
make any reasonable choice on error codes. For instance, we now return
ENOENT for some policy-decisions in case we don't want to leak information
to custom endpoints that cannot see the peer. However, we actually return
ESRCH in we cannot find a name later. This is really hard to track down
because both errors are generated in totally different code locations.

This commit does not fix those, it only turns the 'int' into a 'bool'.
Follow-ups will fix the error-code mess.

Signed-off-by: David Herrmann <dh.herrmann@gmail.com>
connection: fix information leak on !SEE for real

In the past we noticed that if you cannot SEE a name, we should not return
EPERM but ENOENT. Otherwise, you will notice the name exists in case the
policy-check is done _after_ looking up the name.

For NAME queries we're fine, but for ID queries we're not. Lets fix this
all at once and make both lookup and policy-check use the same code-path,
and thus the same error-code.

Also add tests to verify both error codes are always the same. There is no
reason to let user-space know "you're allowed to see that name but it
doesn't exist". Stop that crazy and just return the same error regardless
whether you cannot see it or whether it doesn't exist.

Signed-off-by: David Herrmann <dh.herrmann@gmail.com>
policy: return highest policy on kdbus_policy_query()

Instead of asking for a specific policy level, we now always return the
highest level found. That means, kdbus_policy_query() always searches
through all access-entries of a given name-entry and tries to find the
highest access-level that matches.

Note that this means we cannot shortcut the policy-check on a single name.
However, that should not affect the performance considerably. But the
upside is we now can properly cache any result of the policy-db. There is
no reason to limit it to TALK. Instead, a policy cache can properly take
the policy result and just cache it, regardless of the call-side.

Signed-off-by: David Herrmann <dh.herrmann@gmail.com>
policy: drop unused kdbus_policy_check_access()

Inline this helper into kdbus_policy_query_unlocked(). No reason to split
both. The query helper is a one-liner and the only caller of
check_access().

Signed-off-by: David Herrmann <dh.herrmann@gmail.com>
policy: drop unused 'wildcard' parameter

This argument is unused, drop it from kdbus_policy_lookup().

Signed-off-by: David Herrmann <dh.herrmann@gmail.com>
util: kdbus_str_hash() -> kdbus_strhash()

Lets make this function look more like strlen(), strcopy(), ... and
friends. Not that I like it in particular, but a followup will introduce
kdbus_strnhash() and those names get really weird once used with
underscore style.

Signed-off-by: David Herrmann <dh.herrmann@gmail.com>
policy: optimize wildcard entry lookup

There is really no reason to duplicate the lookup string if all we do is
prefix comparison. Introduce kdbus_strnhash() and then do proper prefix
comparison in kdbus_policy_lookup() without string modification.

There is a reason DBus uses reverse DNS-notation. Use it!

Signed-off-by: David Herrmann <dh.herrmann@gmail.com>
kdbus.h: add KDBUS_ITEM_CANCEL_FD (ABI break)

Add a new item that takes a file descriptor, used to cancel a synchronous
SEND operation.

Signed-off-by: Daniel Mack <daniel@zonque.org>
connection: pass struct file from ioctl handler to kdbus_conn_kmsg_send()

We need to have access to the struct file that was used to issue the
ioctl later, so let's pass it down to kdbus_conn_kmsg_send().

Signed-off-by: Daniel Mack <daniel@zonque.org>
connection: accept eventfd as cancellation point

Allow passing in a CANCEL_FD item with the send command (attached to
the command, not the message!) that carries a file descriptor.

When userspace writes to this fd, use it as cancellation point an
return -ECANCELED to the blocking caller of KDBUS_CMD_SEND.

For this to work, we have to sleep on two wait queues now - one for
our own connection, one for the passed in fd. For this, open-code
what select() does, and use a struct poll_wqueues on the stack
to attach both wake up source to it. Then use poll_schedule_timeout()
to actually put the task to sleep. However, we have to implement
the condition checking ourselves, in a busy loop.

item->fds[0] may be any type of file descriptor that implements
poll(). For instance, an eventfd.

Signed-off-by: Daniel Mack <daniel@zonque.org>
test: add cancel_fd parameter to kdbus_msg_send_sync()

Add another parameter to kdbus_msg_send_sync() which should be set
to -1 if unused. If >= 0, it will cause the SEND cmd ioctl to carry
an item of type KDBUS_ITEM_CANCEL_FD, and put the given value into
it.

Signed-off-by: Daniel Mack <daniel@zonque.org>
test-sync: add test for cancelling a sync send with an eventfd

Fork a process, issue a blocking send with a cancelfd, and kill the
command by writing to the cancel fd.

Signed-off-by: Daniel Mack <daniel@zonque.org>
connection: trigger on cancel_fd->poll() & POLLIN

POLLIN is the event we're waiting for, not POLLOUT.

Signed-off-by: Daniel Mack <daniel@zonque.org>
kdbus.txt, Changelog: document KDBUS_ITEM_CANCEL_FD

Signed-off-by: Daniel Mack <daniel@zonque.org>
connection: add comment on init_poll_funcptr()

Signed-off-by: Daniel Mack <daniel@zonque.org>
connection: don't break lines unless we have to

Signed-off-by: Daniel Mack <daniel@zonque.org>
connection: don't oops if CANCEL_FD doesn't support poll

Verify the passed CANCEL_FD does actually support ->poll(). Otherwise, we
will call a NULL pointer.

Signed-off-by: David Herrmann <dh.herrmann@gmail.com>
connection: minor comment nit

Signed-off-by: Daniel Mack <daniel@zonque.org>