session: Clear environment when running cockpit-session setuid

Environment variables can affect all sorts of things like LD_PRELOAD,
PAM module behavior, and so on. When cockpit-session is running as
a setuid process, clear the environment completely.

This means that for debugging using G_DEBUG or G_MESSAGES_DEBUG
cockpit-ws must be running as root. Update HACKING.md to reflect this.

Closes #1123
Reviewed-by: Marius Vollmer <marius.vollmer@redhat.com>
shell: Disable chunk size for RAID 1

Disable the selectpicker for RAID 1
Show the text "0 KB" for RAID 1
Set the chunk size to 0 when creating RAID devices

Fixes #1071
Closes #1089
Reviewed-by: Marius Vollmer <marius.vollmer@redhat.com>
 * Hide the chunk row, don't dig into selectpicker internals.
ws: Only one code path for starting local cockpit-session process

Don't automatically launch local cockpit-session processes when
opening channels. The only way to get one is via a /login.

This simplifies the authentication code, but more importantly
once GSSAPI is implemented, we won't necessarily have the credentials
to just launch a cockpit-session whenever we want.

Reviewed-by: Marius Vollmer <marius.vollmer@redhat.com>
ws: Log the user out when the primary session goes away

If the primary session goes away (eg: via a kill command or crash)
then log the user out of the web service all together.

Reviewed-by: Marius Vollmer <marius.vollmer@redhat.com>
ws: Move cockpit-session code to src/ws/ directory

It's really part of the webservice code rather than the agent, and the
API that cockpit-ws and cockpit-session talk is pretty tightly bound.

Reviewed-by: Marius Vollmer <marius.vollmer@redhat.com>
common: When JSON data to parse is empty, raise an error

Explicitly raise an error when JSON data to parse is empty.
This was causing issues when empty data would come from cockpit-session.

Reviewed-by: Marius Vollmer <marius.vollmer@redhat.com>
ws: In preparation for GSSAPI move authentication to headers

Use the standard Authorization header and Basic auth for authenticating
via passwords.

We parse the authorization header in cockpit-session, similarly to how
we'll be doing for the GSSAPI (ie: kerberos auth)

Reviewed-by: Marius Vollmer <marius.vollmer@redhat.com>
ws: Pass headers to CockpitAuth login_finish() virtual method

In our GSSAPI authentication we'll be adding custom headers from
the implementations of this virtual method.

Reviewed-by: Marius Vollmer <marius.vollmer@redhat.com>
ws: Remove support from CockpitWebServer for handling POST reqs

This is no longer used or needed. Conceptually we should never be
handling POST requests because we have no CSRF protection, or anything like
that anyway.

Anything that changes state should go through thet WebSocket.

Closes #1114
Reviewed-by: Marius Vollmer <marius.vollmer@redhat.com>
test: Adapt check-multi-machine.

Killing the "admin" session on m1 now results in a log out, so the
test uses m2 and m3 instead.
selinux: Comment out file context for cockpit-agent

selinux-policy-targetted puts the cockpit-agent file context in the
wrong selinux module, so we cannot replace it. For now just rely on
that definition to be correct and comment this out here.

https://bugzilla.redhat.com/show_bug.cgi?id=1139138

Reviewed-by: Marius Vollmer <marius.vollmer@redhat.com>
selinux: Our own version number for cockpit selinux policy

This lets us easily see whether it's installed or not. Like
this:

$ sudo semodule -l | grep cockpit

Closes #1136
Reviewed-by: Marius Vollmer <marius.vollmer@redhat.com>
shell: Include smartd.service in Storage Journal

Fixes #1052
Closes #1135
Reviewed-by: Stef Walter <stefw@redhat.com>
shell: Use a select-picker to implement cockpit.select_btn.

Fixes #1087
Fixes #1081
Closes #1122
Reviewed-by: Stef Walter <stefw@redhat.com>
test: Print out qemu command when doing verbose testing

Reviewed-by: Marius Vollmer <marius.vollmer@redhat.com>
test: Work around for qemu 2.1.x bugs with powerdown

qemu 2.1.x has some bugs with powering off via ACPI, and qemu
not exiting when the VM halts. Add workaround for these for now.

https://bugzilla.redhat.com/show_bug.cgi?id=1139387
https://bugzilla.redhat.com/show_bug.cgi?id=1139357

Closes #1138
Reviewed-by: Marius Vollmer <marius.vollmer@redhat.com>
Release version 0.23
shell: Improve label text for locked account.

Fixes #1147
Closes #1148
Reviewed-by: Marius Vollmer <marius.vollmer@redhat.com>
shell: Improve button label and dialog title when creating new account

Fixes #1149
Closes #1150
Reviewed-by: Marius Vollmer <marius.vollmer@redhat.com>
shell: Clarified description for time span selection in journal

Fixes #437
Closes #1154
Reviewed-by: Marius Vollmer <marius.vollmer@redhat.com>