connection: handle -EINTR correctly

When our sync send call is interrupted, we need to store our saved
sigmask to current->saved_sigmask and call set_restore_sigmask().

Signed-off-by: Daniel Mack <daniel@zonque.org>
connection: kdbus_conn_kmsg_send(): cmd_send cannot be NULL

There's only one caller of kdbus_conn_kmsg_send(), and it ensures
that cmd_send is never NULL. No need to check or allow that.

While at it, shorten the name to 'cmd'.

Signed-off-by: Daniel Mack <daniel@zonque.org>
connection: check for invalid items in kdbus_conn_kmsg_send()

Iterate the items and reject everything but KDBUS_ITEM_SIGMASK.

Signed-off-by: Daniel Mack <daniel@zonque.org>
kdbus.txt: document KDBUS_ITEM_SIGMASK

Signed-off-by: Daniel Mack <daniel@zonque.org>
connection: sync send do not block SIGKILL or SIGSTOP

SIGKILL and SIGSTOP can't be blocked so clear them out before applying
the sigmask.

Signed-off-by: Djalal Harouni <tixxdz@opendz.org>
connection: kdbus_ep_policy_check_own_access() -> kdbus_conn_policy_own_name()

The OWN access check is not a property of an endpoint, but of a
connection. Move the function to connection.c and drop the "endpoint"
argument.

Furthermore, prepare for further renamed and use the common
kdbus_conn_policy() prefix.

Signed-off-by: David Herrmann <dh.herrmann@gmail.com>
connection: kdbus_conn_kmsg_send() -> kdbus_cmd_msg_send()

The _kmsg_send() function is no longer used for non-ioctl messages, so we
can mark it as command dispatcher now, like all the other kdbus_cmd_msg_*
helpers we already have.

This also allows us to drop the "ep" argument, as we can safely use
conn_src->ep now.

Signed-off-by: David Herrmann <dh.herrmann@gmail.com>
connection: drop superfluous argument to kdbus_conn_check_access()

The endpoint is always the endpoint of the source connection. Drop it and
re-order arguments to more reflect the functions nature.

Signed-off-by: David Herrmann <dh.herrmann@gmail.com>
connection: kdbus_ep_policy_check_talk_access() -> kdbus_conn_policy_talk()

Same as for kdbus_conn_policy_own_name(), move the policy helper where it
belongs. Also drop the 'ep' argument as it is redundant.

Signed-off-by: David Herrmann <dh.herrmann@gmail.com>
connection: kdbus_ep_policy_check_see_access* -> kdbus_conn_policy_see_name()

Same as the other policy helpers, move SEE verification to connection.c
and drop the endpoint argument. It's always implicitly given via the
connection.

Also follow the easier naming style that does not clash with policy.c.

Signed-off-by: David Herrmann <dh.herrmann@gmail.com>
connection: dont lock subjects on SEE policy check

There is no need to lock the source connection when checking SEE policies.
The only reason connection locks are needed is if we iterate the target
names. We never do that during simple SEE policy checks (but only during
full target connection SEE checks), so drop that lock.

Signed-off-by: David Herrmann <dh.herrmann@gmail.com>
connection: kdbus_ep_policy_check_src_names() -> kdbus_conn_policy_see()

Same as the previous policy helpers, move SRC-NAME verification to
connection.c. Furthermore, rename the function to a subject-based name:
  kdbus_conn_policy_see(conn, whom)
It now verifies whether @conn can see @whom, which is what we really want
to know. The fact that this relies on the destination names is irrelevant
for the call-side. Policy is based on SEE policies, so let it look like it
really is.

This again allows us to drop the 'ep' argument as it is implicitly given
by the subject 'conn'.

Signed-off-by: David Herrmann <dh.herrmann@gmail.com>
connection: re-write notification policy

Rewrite the notification policy check and add justifications why the
different types are dropped. Also add proper WARN()s instead of silently
rejecting invalid callers.

Signed-off-by: David Herrmann <dh.herrmann@gmail.com>
policy: speed-up and simplify query helpers

Instead of hard-coding each policy-db query type, this commit provides
kdbus_policy_query() and kdbus_policy_query_unlocked(). So far, they're
only used for SEE and OWN, but TALK can also be converted.

The policy DB is seen as generic entity from the outside, so we should
push any non-policy decisions into it. The authority on the policy
application is the bus, the endpoint or the connection, so keep it there.

Furthermore, we now pass the name-hash into the function, so we don't have
to hash multiple times if we query multiple DBs like with custom
endpoints.

Signed-off-by: David Herrmann <dh.herrmann@gmail.com>
connection: drop unused includes/declarations

Drop the dead kdbus_conn_namespace_eq() declaration and any namespace
includes. Add them to metadata.c where they're actually used.

Signed-off-by: David Herrmann <dh.herrmann@gmail.com>
purge: drop talk cache

Once we use current->creds as policy credentials for UNICASTS, and
file->f_creds for receiver-based policy checks, we cannot use the cache as
we have it now. The creds may change at any time and it's not clear which
creds were used for a given policy check.

Furthermore, the current cache is highly inefficient. It uses only 64
buckets for the whole bus cache. It needs exclusive locking for lookups
and requires _full_ cache traversals whenever a name changes ownership, a
connection dies or a policy is changed.

Drop the cache for now.

Once our code is considered ready and we do benchmarking, we can re-add
it. However, I really think it should look more like this:

    Each *connection* has a policy-cache. This caches the results of the
    respective kdbus_policy_query() calls so we can skip calling into the
    policy (and thus skip locking the policy/bus) on cache hits. On cache
    misses, we call into the policy and cache the result with a back-link
    to the policy-entry that produced this result. Whenever the policy-db
    changes, it drops all cache entries that were generated by a given
    policy-entry.

    As a bonus, our cache can be based on conn->lock. There is no need to
    lock all caches. Furthermore, the policy-db can be updated to use RCU
    as policy-db modifications are definitely not considered a fast-path.
    We then can synchronize on policy-updates and get a lock-free policy
    db.

Anyway, unless someone does some benchmarking, it seems rather useless to
create policy-caches. Lets drop it for now, get everything in place
underneath and re-add it later, if needed (and yeah, chances are high that
some sort of optimization is needed).

Signed-off-by: David Herrmann <dh.herrmann@gmail.com>
policy: drop kdbus_policy_check_talk_access()

This helper is now redundant. We already have the same iterator in
connection.c. Move it into its own function and then drop the
policy-helper.

Signed-off-by: David Herrmann <dh.herrmann@gmail.com>