session: Make sure our auth file descriptor gets closed on exec

We never want the auth file descriptor to leak to the unpriveleged
cockpit-agent. Although we close all extra file descriptors before
execing(), this is a double insurance against future refactoring.

Closes #1225
Reviewed-by: Marius Vollmer <marius.vollmer@redhat.com>
shell: Rules for overflow of user account boxes.

Fixes #1211
Closes #1231
Reviewed-by: Marius Vollmer <marius.vollmer@redhat.com>
shell: Move find_logical_volume_block to file scope

Reviewed-by: Stef Walter <stefw@redhat.com>
shell, daemon: Optionally resize filesystem together with logical volume

And provide a good default.

Fixes #1129
Reviewed-by: Stef Walter <stefw@redhat.com>
test: Depend on storaged 0.3.1

For the 'resize_fsys' option.

Reviewed-by: Stef Walter <stefw@redhat.com>
test: Enable updates-testing for mock

Reviewed-by: Stef Walter <stefw@redhat.com>
test: Check resizing of mounted filesystems

Closes #1173
Reviewed-by: Stef Walter <stefw@redhat.com>
daemon: Allow "wheel" to change hostnames

By allowing interactive authentication when talking to hostnamed.

Closes #1201
Reviewed-by: Stef Walter <stefw@redhat.com>
configure: Link appropriate binaries to krb5 libraries

Reviewed-by: Marius Vollmer <marius.vollmer@redhat.com>
common: Utility function for decoding hex strings

And tests

Reviewed-by: Marius Vollmer <marius.vollmer@redhat.com>
ws: Implement basic GSSAPI kerberos authentication

The actual authentication happens in cockpit-session, which has
access to the keytab

Reviewed-by: Marius Vollmer <marius.vollmer@redhat.com>
ws: Implement basic testing of kerberos auth during 'make check'

This requires the 'krb5-server' package or similar to be installed
while running 'make check'

Reviewed-by: Marius Vollmer <marius.vollmer@redhat.com>
static: Try an SSO login before showing the login form

This allows kerberos (ie: Negotiate, GSSAPI) SSO authentication to
happen before showing a login form.

Fixes #57
Reviewed-by: Marius Vollmer <marius.vollmer@redhat.com>
static: Don't use single sign-in if user explicitly logged out

When the user explicitly logged out, don't try and use single
sign in to authenticate. Otherwise the user would just be logged
in again.

There are two use cases here:

 * The user wants to finish the session and log out
 * The user wants to log in as someone else

So we force display of the login form in the case where logout
was explicitly used.

Reviewed-by: Marius Vollmer <marius.vollmer@redhat.com>
ws: Send WWW-Authenticate: Negotiate header for any auth failure

Reviewed-by: Marius Vollmer <marius.vollmer@redhat.com>
ws: Test kerberos against host@COCKPIT keytab credentials

This is how it is used with Active Directory, and not necessarily
with HTTP specific kerberos SPN.

Reviewed-by: Marius Vollmer <marius.vollmer@redhat.com>
ws: If we can't resolve a real local name, use fully qualified

Use fully qualified kerberos user name if we cannot resolve it
into a valid local user via the kerberos routines.

Reviewed-by: Marius Vollmer <marius.vollmer@redhat.com>
test: Check negotiate authentication

Reviewed-by: Marius Vollmer <marius.vollmer@redhat.com>
selinux: cockpit-session uses GSSAPI which wants to write to tmpdir

GSSAPI writes to a replay cache. cockpit-session now uses GSSAPI
and needs to be able to write, read, delete from tmpdir

Symptom:

cockpit-session: gssapi auth failed: Unspecified GSS failure.
	Minor code may provide more information (Cannot create replay
	cache file /var/tmp/HTTP_0: File exists)

Reviewed-by: Marius Vollmer <marius.vollmer@redhat.com>
HACKING: Add instructions for how to configure SSO

This is a bit convoluted currently, but it's important to make this
reproducable and for people to be able to develop against it ... or
it will never ever get better.

Closes #1124