Re: How to find out which process is accessing the card?
František Řezáč <[email protected]> Tue, 24 Oct 2017 10:28:35 +0200
| Newsgroups | gmane.comp.lib.muscle |
|---|---|
| Message-ID | <CAOe3-faaCSPnD7rxDHfa8nzvB5-W7DcTgRvpTAzATC+CJpFUFQ@mail.gmail.com> |
--===============4049525862459222626== Content-Type: multipart/alternative; boundary="94eb2c06ed9aabce8e055c46b967" --94eb2c06ed9aabce8e055c46b967 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable I was surprised by your solution based on proc/maps, I expected something more specific to the pcsc stack, but I gave it a try and I think I have found what I'm looking for. But it wasn't straightforward so I'm sending some notes back. Most importantly I was surprised how many processes are running with pcsc lib all the time. For example I definitely wasn't expecting wpasupplicant. Those processes however were not accessing smart card at all so I had to conduct a better analysis looking at those processes found by your tool for a longer time and I found a behavior pattern which pointed to the final offender (gdm-session-worker). So although it wasn't as simple as I would like, your tool helped a lot, thanks. 2017-09-28 14:45 GMT+02:00 Ludovic Rousseau <[email protected]>: > 2017-09-27 21:58 GMT+02:00 Franti=C5=A1ek =C5=98ez=C3=A1=C4=8D <frantisek= [email protected]> > : > >> Hi, >> > > Hello, > > >> >> I'm using smart card for almost everything in my daily work, but I have = a >> problem which drives me crazy. I'm using YubiKey in two scenarios: pkcs1= 1 >> based PAM and SSH authentication and also as a GPG=E2=80=8E smart card. = I >> understand that accesing one card via pkcs11 and scdaemon in turns is >> troubling, because GPG tends to lock the access to the card for itself f= ull >> time, but I can handle that by manualy terminating scdaemon. >> >> But I have also come across the opossite situation many times - somethin= g >> locks access to the card via pkcs11 which prevents the access from scdae= mon >> with the dreaded "PC/SC OPEN failed: sharing violation". The problem is >> that I don't know which process is using the card so I don't know how to >> deal with it except for restarting the whole pcscd. Also this problem se= ems >> to happen randomly so I don't have any clue if it's pam module or ssh ag= ent >> or something else and it also randomly disappears. If I know what is usi= ng >> the card, I could try to configure it better or deal with it more gently= . >> >> And that's my question - how to find out what is currently >> accessing/locking the card at a given time? I tried to figure it out >> myself, but after I have seen this schema https://blog.flameeyes. >> eu/2011/04/additional-notes-about-the-smartcard-components-diagram/ I >> realized that I don't even know at which level I should look for that >> information. >> > > I just wrote a script for you. > https://github.com/LudovicRousseau/contrib/blob/ > master/list_pcsc_applications.sh > > Please tell me if it works for you or if you need something different. > > Bye > > -- > Dr. Ludovic Rousseau > > _______________________________________________ > Pcsclite-muscle mailing list > [email protected] > http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/pcsclite-muscle > --=20 Franti=C5=A1ek http://calavera.info/ --94eb2c06ed9aabce8e055c46b967 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable <div dir=3D"ltr">I was surprised by your solution based on proc/maps, I exp= ected something more specific to the pcsc stack, but I gave it a try and I = think I have found what I'm looking for. But it wasn't straightforw= ard so I'm sending some notes back.<div><br></div><div>Most importantly= I was surprised how many processes are running with pcsc lib all the time.= For example I definitely wasn't expecting wpasupplicant. Those process= es however were not accessing smart card at all so I had to conduct a bette= r analysis looking at those processes found by your tool for a longer time = and I found a behavior pattern which pointed to the final offender (gdm-ses= sion-worker). So although it wasn't as simple as I would like, your too= l helped a lot, thanks.</div></div><div class=3D"gmail_extra"><br><div clas= s=3D"gmail_quote">2017-09-28 14:45 GMT+02:00 Ludovic Rousseau <span dir=3D"= ltr"><<a href=3D"mailto:[email protected]" target=3D"_blank">lu= [email protected]</a>></span>:<br><blockquote class=3D"gmail_quot= e" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">= <div dir=3D"ltr"><div class=3D"gmail_extra"><div class=3D"gmail_quote">2017= -09-27 21:58 GMT+02:00 Franti=C5=A1ek =C5=98ez=C3=A1=C4=8D <span dir=3D"ltr= "><<a href=3D"mailto:[email protected]" target=3D"_blank">fr= [email protected]</a><wbr>></span>:<br><blockquote class=3D"gm= ail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,= 204,204);padding-left:1ex"><div dir=3D"ltr">Hi,</div></blockquote><div><br>= </div><div>Hello,<br>=C2=A0<br></div><span class=3D""><blockquote class=3D"= gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(20= 4,204,204);padding-left:1ex"><div dir=3D"ltr"><div><br>I'm using smart = card for almost everything in my daily work, but I have a problem which dri= ves me crazy. I'm using YubiKey in two scenarios: pkcs11 based PAM and = SSH authentication and also as a GPG=E2=80=8E smart card. I understand that= accesing one card via pkcs11 and scdaemon in turns is troubling, because G= PG tends to lock the access to the card for itself full time, but I can han= dle that by manualy terminating scdaemon.</div><div><br></div><div>But I ha= ve also come across the opossite situation many times - something locks acc= ess to the card via pkcs11 which prevents the access from scdaemon with the= dreaded "PC/SC OPEN failed: sharing violation". The problem is t= hat I don't know which process is using the card so I don't know ho= w to deal with it except for restarting the whole pcscd. Also this problem = seems to happen randomly so I don't have any clue if it's pam modul= e or ssh agent or something else and it also randomly disappears. If I know= what is using the card, I could try to configure it better or deal with it= more gently.</div><div><br></div><div>And that's my question - how to = find out what is currently accessing/locking the card at a given time? I tr= ied to figure it out myself, but after I have seen this schema=C2=A0<a href= =3D"https://blog.flameeyes.eu/2011/04/additional-notes-about-the-smartcard-= components-diagram/" target=3D"_blank">https://blog.flameeyes.<wbr>eu/2011/= 04/additional-notes-ab<wbr>out-the-smartcard-components-<wbr>diagram/</a> I= realized that I don't even know at which level I should look for that = information.<br></div></div></blockquote></span></div><br></div><div class= =3D"gmail_extra">I just wrote a script for you.<br><a href=3D"https://githu= b.com/LudovicRousseau/contrib/blob/master/list_pcsc_applications.sh" target= =3D"_blank">https://github.com/<wbr>LudovicRousseau/contrib/blob/<wbr>maste= r/list_pcsc_applications.<wbr>sh</a><br></div><div class=3D"gmail_extra"><b= r></div><div class=3D"gmail_extra">Please tell me if it works for you or if= you need something different.<br><br></div><div class=3D"gmail_extra">Bye<= span class=3D"HOEnZb"><font color=3D"#888888"><br clear=3D"all"></font></sp= an></div><span class=3D"HOEnZb"><font color=3D"#888888"><div class=3D"gmail= _extra"><br>-- <br><div class=3D"m_-8123142479502014381gmail_signature">=C2= =A0Dr. Ludovic Rousseau</div> </div></font></span></div> <br>______________________________<wbr>_________________<br> Pcsclite-muscle mailing list<br> <a href=3D"mailto:[email protected]">Pcsclite-muscle@= lists.alioth.<wbr>debian.org</a><br> <a href=3D"http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/pcsclite= -muscle" rel=3D"noreferrer" target=3D"_blank">http://lists.alioth.debian.<w= br>org/cgi-bin/mailman/listinfo/<wbr>pcsclite-muscle</a><br></blockquote></= div><br><br clear=3D"all"><div><br></div>-- <br><div class=3D"gmail_signatu= re" data-smartmail=3D"gmail_signature">Franti=C5=A1ek<br><a href=3D"http://= calavera.info/" target=3D"_blank">http://calavera.info/</a></div> </div> --94eb2c06ed9aabce8e055c46b967-- --===============4049525862459222626== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Pcsclite-muscle mailing list [email protected] http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/pcsclite-muscle --===============4049525862459222626==--