xaccess: Rework from boolean into a list of tags (#40645)

Fixes: #40634

man/org.freedesktop.login1.xml

@@ -1246,7 +1246,7 @@ node /org/freedesktop/login1/session/1 {
       @org.freedesktop.DBus.Property.EmitsChangedSignal("const")
       readonly s RemoteUser = '...';
       @org.freedesktop.DBus.Property.EmitsChangedSignal("const")
-      readonly b ExtraDeviceAccess = ...;
+      readonly as ExtraDeviceAccess = ['...', ...];
       @org.freedesktop.DBus.Property.EmitsChangedSignal("const")
       readonly s Service = '...';
       @org.freedesktop.DBus.Property.EmitsChangedSignal("const")
@@ -1541,9 +1541,9 @@ node /org/freedesktop/login1/session/1 {
       <para><varname>RemoteHost</varname> and <varname>RemoteUser</varname> encode the remote host and user
       if this is a remote session, or an empty string otherwise.</para>
 
-      <para><varname>ExtraDeviceAccess</varname> encodes whether the session is granted access to additional
-      hardware devices, typically useful for for graphical, remote session. If true, the session is granted
-      access to all devices tagged with <literal>xaccess</literal> in udev.</para>
+      <para><varname>ExtraDeviceAccess</varname> encodes the set of additional hardware devices that the session
+      is granted access to. For every <literal><replaceable>ID</replaceable></literal> in the list, the session
+      is granted access to all devices tagged with <literal>xaccess-<replaceable>ID</replaceable></literal> in udev.</para>
 
       <para><varname>Service</varname> encodes the PAM service name that registered the session.</para>
 

man/pam_systemd.xml

@@ -408,10 +408,9 @@
       <varlistentry>
         <term><varname>$XDG_SESSION_EXTRA_DEVICE_ACCESS</varname></term>
 
-        <listitem><para>Whether or not the session shall be granted additional hardware device access,
-        typically useful for graphical, remote session. If true, the session is granted access to all
-        devices tagged with <literal>xaccess</literal> in udev. Typically, rendering device nodes of
-        the GPU are tagged like this.</para>
+        <listitem><para>The set of additional hardware devices that the session shall be granted access to.
+        For every <literal><replaceable>ID</replaceable></literal> in the list, the session is granted
+        access to all devices tagged with <literal>xaccess-<replaceable>ID</replaceable></literal> in udev.</para>
 
         <xi:include href="version-info.xml" xpointer="v260"/></listitem>
       </varlistentry>

man/rules/meson.build

@@ -926,7 +926,7 @@ manpages = [
    'sd_session_get_uid',
    'sd_session_get_username',
    'sd_session_get_vt',
-   'sd_session_has_extra_device_access',
+   'sd_session_get_extra_device_access',
    'sd_session_is_remote'],
   'HAVE_PAM'],
  ['sd_uid_get_state',

man/sd-login.xml

@@ -191,12 +191,13 @@
       </varlistentry>
 
       <varlistentry>
-        <term>Tag <literal>xaccess</literal></term>
+        <term>Tag <literal>xaccess-*</literal></term>
 
-        <listitem><para>When set, access to this device is granted to sessions
-        created with <literal>ExtraDeviceAccess</literal>. This is typically useful
-        for graphical, remote sessions. As the <literal>ExtraDeviceAccess</literal>
-        sessions open and close, access to the device is updated accordingly.</para>
+        <listitem><para>When <literal>xaccess-<replaceable>ID</replaceable></literal>
+        is set, access to this device is granted to sessions created with
+        <literal><replaceable>ID</replaceable></literal> listed in <literal>ExtraDeviceAccess</literal>.
+        As the sessions with some <literal>ExtraDeviceAccess</literal> open and close,
+        access to the device is updated accordingly.</para>
 
         <xi:include href="version-info.xml" xpointer="v260"/></listitem>
       </varlistentry>

man/sd_session_is_active.xml

@@ -34,7 +34,7 @@
     <refname>sd_session_get_remote_host</refname>
     <refname>sd_session_get_remote_user</refname>
     <refname>sd_session_get_leader</refname>
-    <refname>sd_session_has_extra_device_access</refname>
+    <refname>sd_session_get_extra_device_access</refname>
     <refpurpose>Determine state of a specific session</refpurpose>
   </refnamediv>
 
@@ -143,8 +143,9 @@
       </funcprototype>
 
       <funcprototype>
-        <funcdef>int <function>sd_session_has_extra_device_access</function></funcdef>
+        <funcdef>int <function>sd_session_get_extra_device_access</function></funcdef>
         <paramdef>const char *<parameter>session</parameter></paramdef>
+        <paramdef>char ***<parameter>ret_ids</parameter></paramdef>
       </funcprototype>
     </funcsynopsis>
   </refsynopsisdiv>
@@ -280,11 +281,11 @@
     session identifier. This function will return an error if the seat
     does not support VTs.</para>
 
-    <para><function>sd_session_has_extra_device_access()</function> may
-    be used to determine whether the session is granted access to
-    additional hardware devices, typically useful for for graphical,
-    remote session. If true, the session is granted access to all
-    devices tagged with <literal>xaccess</literal> in udev.</para>
+    <para><function>sd_session_get_extra_device_access()</function> may
+    be used to determine which additional hardware devices the session
+    is granted access to. For every <literal><replaceable>ID</replaceable></literal>
+    in the list, the session is granted access to all devices tagged with
+    <literal>xaccess-<replaceable>ID</replaceable></literal> in udev.</para>
 
     <para>If the <varname>session</varname> parameter of any of these
     functions is passed as <constant>NULL</constant>, the operation is
@@ -296,9 +297,8 @@
     <title>Return Value</title>
 
     <para>If the test succeeds,
-    <function>sd_session_is_active()</function>,
-    <function>sd_session_is_remote()</function>, and
-    <function>sd_session_has_extra_device_access()</function>
+    <function>sd_session_is_active()</function> and
+    <function>sd_session_is_remote()</function>
     return a positive integer; if it fails, 0.  On success,
     <function>sd_session_get_state()</function>,
     <function>sd_session_get_uid()</function>,
@@ -310,9 +310,10 @@
     <function>sd_session_get_display()</function>,
     <function>sd_session_get_leader()</function>,
     <function>sd_session_get_remote_user()</function>,
-    <function>sd_session_get_remote_host()</function> and
-    <function>sd_session_get_tty()</function> return 0 or
-    a positive integer. On failure, these calls return a
+    <function>sd_session_get_remote_host()</function>,
+    <function>sd_session_get_tty()</function>, and
+    <function>sd_session_get_extra_device_access()</function>
+    return 0 or a positive integer. On failure, these calls return a
     negative errno-style error code.</para>
 
     <refsect2>
@@ -366,7 +367,7 @@
     <para><function>sd_session_get_username()</function>,
     <function>sd_session_get_start_time()</function>, and
     <function>sd_session_get_leader()</function> were added in version 254.</para>
-    <para><function>sd_session_has_extra_device_access()</function> was added in version 260.</para>
+    <para><function>sd_session_get_extra_device_access()</function> was added in version 260.</para>
   </refsect1>
 
   <refsect1>