dbus: gate the bus socket like INIT_SOCKET

The D-Bus socket was bound world read/write, on the reasoning that
SO_PEERCRED authorizes each method anyway.  That leaves the read-only
surface open to every local user, and it quietly ignores --with-group:
a system that restricts initctl to the wheel group still handed the
same service state to anyone who asked over the bus.

Bind it 0660 and chown it to the configured group, the same gate the
fallback socket has always had.  libink takes the mode as an argument
rather than assuming one, since who may connect is the embedder's
policy, not the library's.

The mode is applied at bind(), so there is no window where the socket
is more permissive than intended.

Signed-off-by: Joachim Wiberg <troglobit@gmail.com>

test/dbus-auth.sh

@@ -14,9 +14,15 @@ TEST_DIR=$(dirname "$0")
 # shellcheck source=/dev/null
 . "$TEST_DIR/lib/dbus-setup.sh"
 
-say "Socket mode is 0666"
+# The bus reaches every service operation initctl does, so it has to
+# be gated like INIT_SOCKET: 0660, owned by root and the --with-group
+# group.  Only the mode is asserted here, the test namespace does not
+# enforce it -- a setuid() client still connects to a 0660 socket.
+say "Socket is gated like INIT_SOCKET, not world-accessible"
 mode=$(texec stat -c %a "$BUS")
-assert "Socket mode is 666 (got $mode)" "$mode" = "666"
+sock=$(texec stat -c %a /run/finit/socket)
+assert "Socket mode is 660 (got $mode)" "$mode" = "660"
+assert "Bus and INIT_SOCKET agree ($mode vs $sock)" "$mode" = "$sock"
 
 say "AUTH EXTERNAL: claim correct UID (root = 0)"
 reply=$(texec "$CLIENT" auth "$BUS" 0)