Post by Ludovic RousseauPost by Nikos MavrogiannopoulosThe attached patch provides more fine-grained access control. It splits
the access control to PCSC daemon access, and smart card access. The
latter can even be restricted with a polkit ruleset to specific smart cards.
- maybe you should use "org.debian.alioth.pcsc-lite.foobar" instead of
"org.debian.pcsc-lite.foobar" (with alioth added)
Hello,
About the name, I pretty much agree with Martin, and my concern was
whether debian would rename alioth at some point. That's why I didn't
use it. I can add it though if you think it should be there.
Post by Ludovic Rousseau- if the client is not authorized you do not return an error code to
the client. The daemon just closes the communication. This will make
debuging difficult. It would be better to return a specific error to
the client application. But such an error is not (yet) defined by
PC/SC
I'm not aware of the PC/SC protocol. What would you suggest here? Could
it be a pcsc-lite specific error code?
Post by Ludovic Rousseau- do you have a configuration file? Is doc/org.debian.pcsc-lite.policy
the default configuration file?
It is a reasonable default. It has to be copied
to /usr/share/polkit-1/actions/
Post by Ludovic Rousseau- where can I find documentation about the configuration file?
Polkit documentation isn't very verbose. It is documented at:
http://www.freedesktop.org/software/polkit/docs/latest/polkit.8.html
Post by Ludovic Rousseau- how to restrict the access to only specific applications (or processes)?
So more documentation is needed (at least pointers to existing documentation).
As I understand that can be done using rules. I could not find out any
documentation for rules, but they are javascript files placed
in /usr/share/polkit-1/rules.d/
The rules for a specific smart card to be accessible by the web server
(run as httpd user) could be:
polkit.addRule(function(action, subject) {
if (action.id == "org.debian.alioth.pcsc-lite.access_card" &&
action._detail_reader == "name of reader" &&
subject.user == "httpd" && subject.local == true) {
return polkit.Result.YES;
}
});
polkit.addRule(function(action, subject) {
if (action.id == "org.debian.alioth.pcsc-lite.access_pcsc" &&
subject.user == "httpd" && subject.local == true) {
return polkit.Result.YES;
}
});
Post by Ludovic RousseauOn more fundamental question: PC/SC can be used in a PAM module so
_before_ the user is authenticated. How is it supposed to work with a
policy kit configuration that only allows authenticated users?
PAM is executed with root privileges so I don't think that this part
could be affected by polkit (at least not by the default configuration I
included).
regards,
Nikos