compositor: only authorized client can bind desktop_shell

Check, that only the desktop-shell client spawned by the compositor
(desktop-shell plugin) is allowed to bind to desktop_shell interface.
Other clients will receive an error like:

  wl_display@1.error(desktop_shell@20, 0,
  "permission to bind desktop_shell denied")

The error has the proper object id and interface type.

Note: desktop-shell cannot be started manually anymore, it has to be
started by the compositor automatically.

Signed-off-by: Pekka Paalanen <ppaalanen@gmail.com>

compositor/shell.c

@@ -1002,9 +1002,18 @@ bind_desktop_shell(struct wl_client *client,
 		   void *data, uint32_t version, uint32_t id)
 {
 	struct wl_shell *shell = data;
+	struct wl_resource *resource;
+
+	resource = wl_client_add_object(client, &desktop_shell_interface,
+					&desktop_shell_implementation,
+					id, shell);
+
+	if (client == shell->child.client)
+		return;
 
-	wl_client_add_object(client, &desktop_shell_interface,
-			     &desktop_shell_implementation, id, shell);
+	wl_resource_post_error(resource, WL_DISPLAY_ERROR_INVALID_OBJECT,
+			       "permission to bind desktop_shell denied");
+	wl_resource_destroy(resource, 0);
 }
 
 int