[client] Profile ownership console user tofu (#7529)

* Add consoleuser and stamp default profile on known username in migration

* Refactor consoleuser to verify Id, fix seats on linux and default stamp

* Add default profile claim

* Add disable auto-claim of default profile and always fail close

* Add disable auto-claim flag to migration

* Adding timeout to console user on Linux and close library load on darwin

* Fixed failed close test

* Close both Dlopen for darwin

* Replace RegisterFunc with purego.Dlsym to avoid possible panic

* Fix freebsd tty enumeration

* Fix active profile migration logic and add test

* Log defaultClaimDisabled error once

* Guard against panicking console user lookup.

* Fix merge conflict

* Fix broken tests

client/internal/ipcauth/consoleuser_test.go

@@ -0,0 +1,54 @@
+package ipcauth
+
+import "testing"
+
+// An identity the kernel never vouched for must not reach a console lookup at
+// all: the zero Identity carries uid 0, which a platform lookup would
+// otherwise compare against a root session.
+func TestIsConsoleUserRejectsUnattestedIdentity(t *testing.T) {
+	for _, tc := range []struct {
+		name string
+		id   Identity
+	}{
+		{"zero identity", Identity{}},
+		{"unattested uid 0", Identity{UID: 0}},
+		{"unattested uid", Identity{UID: 1000}},
+		{"unattested sid", Identity{SID: "S-1-5-21-1-2-3-1001"}},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			if IsConsoleUser(tc.id) {
+				t.Fatal("an identity the kernel did not vouch for was reported as a console user")
+			}
+		})
+	}
+}
+
+// A lookup that panics must read as "cannot confirm". The daemon installs no
+// gRPC recovery interceptor, so without this the panic ends the process from
+// inside the per-RPC authorization path.
+func TestGuardConsoleLookupContainsAPanic(t *testing.T) {
+	id := KnownForTest(Identity{UID: 1000})
+
+	if guardConsoleLookup(id, func(Identity) bool {
+		panic("pretending purego could not map a signature")
+	}) {
+		t.Fatal("a panicking lookup reported the caller as being at the console")
+	}
+}
+
+// The guard must not swallow a real answer on its way out.
+func TestGuardConsoleLookupPassesTheAnswerThrough(t *testing.T) {
+	id := KnownForTest(Identity{UID: 1000})
+
+	if !guardConsoleLookup(id, func(got Identity) bool {
+		if got.UID != id.UID {
+			t.Fatalf("lookup received uid %d, want %d", got.UID, id.UID)
+		}
+		return true
+	}) {
+		t.Fatal("a lookup that found the caller at the console reported false")
+	}
+	if guardConsoleLookup(id, func(Identity) bool { return false }) {
+		t.Fatal("a lookup that found nobody reported true")
+	}
+}