document-portal: Verify access right on fds
document-portal: Verify access right on fds

We call access() on the file descriptors passed to the portal. To
create a document from an existing file you need read access to it,
and for a non-existing one you need read and execute on the parent
directory.

We also check for write access and only grant the caller write permissions
if that is available.

This means you can't for instance create a document for a read-only
bindmount in the sandbox (that is read-write on the host) and acquire
read-write access to the file. It also means you can't create a
read-write document for a file which has no write permissions for the
user, even though the user could conceptually chmod it to gain such
permissions. This is a tiny behaviour change, but is unlikely to be
of practial concerns.

The check itself is done with /proc/self/fd/$fd on the passed in file
descriptor from the requesting app. This will do the lookup via the
mountpoint in the sandbox, and thus apply the mount flags (for example
read-only flags) from it.

This at least partially fixes https://github.com/flatpak/xdg-desktop-portal/issues/167

matthiasclasen/xdg-desktop-portal,flatpak/xdg-desktop-portal,flatpak/xdg-desktop-portal,matthiasclasen/xdg-desktop-portal,matthiasclasen/xdg-desktop-portal,flatpak/xdg-desktop-portal,matthiasclasen/xdg-desktop-portal,flatpak/xdg-desktop-portal,matthiasclasen/xdg-desktop-portal