libink/dbus: identify the caller behind a broker

On the local bus SO_PEERCRED says who is calling and the kernel is the
one saying it.  Behind a broker one connection carries every caller,
so that credential describes dbus-daemon and nothing else, and every
privileged method was refused there, root included.

Ask the bus driver instead.  libink parks the call and hands us the
sender; we ask GetConnectionUnixUser and answer when the reply lands,
through the same event loop as everything else.  Nothing blocks:
blocking in PID 1 is why libuEv exists.  That needs calls libink can
make on a connection it already has, so it gained those too.

Answers are cached, since a bus never reuses a unique name while it
runs.  Not across a restart though: a new dbus-daemon numbers from
scratch and :1.7 becomes somebody else, so the cache goes when the
broker does.  A sender name too long to key on is refused rather than
truncated, two callers sharing a truncated key would share an
identity.

Privilege is no longer uid 0 alone.  The socket is already owned by
the --with-group group, so refusing its members every method that
changes anything left a wheel user able to open the bus and unable to
reboot.  Both gates now say the same thing.

Group membership needs NSS, which the C library loads with dlopen(),
so the lookup is compiled out where Finit is built to link statically.
That leaves such a build root-only, which is worth saying out loud
rather than leaving to be discovered.

Signed-off-by: Joachim Wiberg <troglobit@gmail.com>

libink/server.c

@@ -159,10 +159,27 @@ int link_server_accept(link_server_t *srv, link_connection_t **out)
 
 	__auth_generate_guid(conn->guid);
 
+
 	*out = conn;
 	return 0;
 }
 
+void link_server_set_uid_resolver(link_server_t *srv, link_uid_resolver_t cb, void *userdata)
+{
+	if (!srv)
+		return;
+	srv->uid_resolver = cb;
+	srv->uid_userdata = userdata;
+}
+
+void link_server_set_authorizer(link_server_t *srv, link_authorizer_t cb, void *userdata)
+{
+	if (!srv)
+		return;
+	srv->authorizer     = cb;
+	srv->authz_userdata = userdata;
+}
+
 link_connection_t *link_server_attach(link_server_t *srv, int fd, uid_t peer_uid,
 				      unsigned int attach_flags)
 {
@@ -199,6 +216,7 @@ link_connection_t *link_server_attach(link_server_t *srv, int fd, uid_t peer_uid
 	conn->broker   = !!(attach_flags & LINK_ATTACH_BROKER);
 	__auth_generate_guid(conn->guid);
 
+
 	return conn;
 
 err_close: