libink/dbus: identify the caller behind a broker

On the local bus SO_PEERCRED says who is calling and the kernel is the
one saying it.  Behind a broker one connection carries every caller,
so that credential describes dbus-daemon and nothing else, and every
privileged method was refused there, root included.

Ask the bus driver instead.  libink parks the call and hands us the
sender; we ask GetConnectionUnixUser and answer when the reply lands,
through the same event loop as everything else.  Nothing blocks:
blocking in PID 1 is why libuEv exists.  That needs calls libink can
make on a connection it already has, so it gained those too.

Answers are cached, since a bus never reuses a unique name while it
runs.  Not across a restart though: a new dbus-daemon numbers from
scratch and :1.7 becomes somebody else, so the cache goes when the
broker does.  A sender name too long to key on is refused rather than
truncated, two callers sharing a truncated key would share an
identity.

Privilege is no longer uid 0 alone.  The socket is already owned by
the --with-group group, so refusing its members every method that
changes anything left a wheel user able to open the bus and unable to
reboot.  Both gates now say the same thing.

Group membership needs NSS, which the C library loads with dlopen(),
so the lookup is compiled out where Finit is built to link statically.
That leaves such a build root-only, which is worth saying out loud
rather than leaving to be discovered.

Signed-off-by: Joachim Wiberg <troglobit@gmail.com>

libink/marshal.c

@@ -376,3 +376,34 @@ int __r_array_begin(struct link_reader *r, size_t *out_end)
 	*out_end = end;
 	return 0;
 }
+
+ssize_t __marshal_va(uint8_t *body, size_t cap, const char *sig, va_list ap)
+{
+	struct link_writer w;
+	const char        *s;
+
+	__w_init(&w, body, cap);
+	for (s = sig; *s; s++) {
+		switch (*s) {
+		case 'y':
+			__w_byte(&w, (uint8_t)va_arg(ap, int));
+			break;
+		case 'b':
+			__w_bool(&w, va_arg(ap, int));
+			break;
+		case 'u':
+			__w_u32(&w, va_arg(ap, uint32_t));
+			break;
+		case 's':
+			__w_string(&w, va_arg(ap, const char *));
+			break;
+		case 'o':
+			__w_path(&w, va_arg(ap, const char *));
+			break;
+		default:
+			return -1;
+		}
+	}
+
+	return __w_finish(&w);
+}