Re: How to find out which process is accessing the card?

František Řezáč <[email protected]> Tue, 24 Oct 2017 10:28:35 +0200
Newsgroups gmane.comp.lib.muscle
Message-ID <CAOe3-faaCSPnD7rxDHfa8nzvB5-W7DcTgRvpTAzATC+CJpFUFQ@mail.gmail.com>
--===============4049525862459222626==
Content-Type: multipart/alternative; boundary="94eb2c06ed9aabce8e055c46b967"

--94eb2c06ed9aabce8e055c46b967
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

I was surprised by your solution based on proc/maps, I expected something
more specific to the pcsc stack, but I gave it a try and I think I have
found what I'm looking for. But it wasn't straightforward so I'm sending
some notes back.

Most importantly I was surprised how many processes are running with pcsc
lib all the time. For example I definitely wasn't expecting wpasupplicant.
Those processes however were not accessing smart card at all so I had to
conduct a better analysis looking at those processes found by your tool for
a longer time and I found a behavior pattern which pointed to the final
offender (gdm-session-worker). So although it wasn't as simple as I would
like, your tool helped a lot, thanks.

2017-09-28 14:45 GMT+02:00 Ludovic Rousseau <[email protected]>:

> 2017-09-27 21:58 GMT+02:00 Franti=C5=A1ek =C5=98ez=C3=A1=C4=8D <frantisek=
[email protected]>
> :
>
>> Hi,
>>
>
> Hello,
>
>
>>
>> I'm using smart card for almost everything in my daily work, but I have =
a
>> problem which drives me crazy. I'm using YubiKey in two scenarios: pkcs1=
1
>> based PAM and SSH authentication and also as a GPG=E2=80=8E smart card. =
I
>> understand that accesing one card via pkcs11 and scdaemon in turns is
>> troubling, because GPG tends to lock the access to the card for itself f=
ull
>> time, but I can handle that by manualy terminating scdaemon.
>>
>> But I have also come across the opossite situation many times - somethin=
g
>> locks access to the card via pkcs11 which prevents the access from scdae=
mon
>> with the dreaded "PC/SC OPEN failed: sharing violation". The problem is
>> that I don't know which process is using the card so I don't know how to
>> deal with it except for restarting the whole pcscd. Also this problem se=
ems
>> to happen randomly so I don't have any clue if it's pam module or ssh ag=
ent
>> or something else and it also randomly disappears. If I know what is usi=
ng
>> the card, I could try to configure it better or deal with it more gently=
.
>>
>> And that's my question - how to find out what is currently
>> accessing/locking the card at a given time? I tried to figure it out
>> myself, but after I have seen this schema https://blog.flameeyes.
>> eu/2011/04/additional-notes-about-the-smartcard-components-diagram/ I
>> realized that I don't even know at which level I should look for that
>> information.
>>
>
> I just wrote a script for you.
> https://github.com/LudovicRousseau/contrib/blob/
> master/list_pcsc_applications.sh
>
> Please tell me if it works for you or if you need something different.
>
> Bye
>
> --
>  Dr. Ludovic Rousseau
>
> _______________________________________________
> Pcsclite-muscle mailing list
> [email protected]
> http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/pcsclite-muscle
>



--=20
Franti=C5=A1ek
http://calavera.info/

--94eb2c06ed9aabce8e055c46b967
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">I was surprised by your solution based on proc/maps, I exp=
ected something more specific to the pcsc stack, but I gave it a try and I =
think I have found what I&#39;m looking for. But it wasn&#39;t straightforw=
ard so I&#39;m sending some notes back.<div><br></div><div>Most importantly=
 I was surprised how many processes are running with pcsc lib all the time.=
 For example I definitely wasn&#39;t expecting wpasupplicant. Those process=
es however were not accessing smart card at all so I had to conduct a bette=
r analysis looking at those processes found by your tool for a longer time =
and I found a behavior pattern which pointed to the final offender (gdm-ses=
sion-worker). So although it wasn&#39;t as simple as I would like, your too=
l helped a lot, thanks.</div></div><div class=3D"gmail_extra"><br><div clas=
s=3D"gmail_quote">2017-09-28 14:45 GMT+02:00 Ludovic Rousseau <span dir=3D"=
ltr">&lt;<a href=3D"mailto:[email protected]" target=3D"_blank">lu=
[email protected]</a>&gt;</span>:<br><blockquote class=3D"gmail_quot=
e" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">=
<div dir=3D"ltr"><div class=3D"gmail_extra"><div class=3D"gmail_quote">2017=
-09-27 21:58 GMT+02:00 Franti=C5=A1ek =C5=98ez=C3=A1=C4=8D <span dir=3D"ltr=
">&lt;<a href=3D"mailto:[email protected]" target=3D"_blank">fr=
[email protected]</a><wbr>&gt;</span>:<br><blockquote class=3D"gm=
ail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,=
204,204);padding-left:1ex"><div dir=3D"ltr">Hi,</div></blockquote><div><br>=
</div><div>Hello,<br>=C2=A0<br></div><span class=3D""><blockquote class=3D"=
gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(20=
4,204,204);padding-left:1ex"><div dir=3D"ltr"><div><br>I&#39;m using smart =
card for almost everything in my daily work, but I have a problem which dri=
ves me crazy. I&#39;m using YubiKey in two scenarios: pkcs11 based PAM and =
SSH authentication and also as a GPG=E2=80=8E smart card. I understand that=
 accesing one card via pkcs11 and scdaemon in turns is troubling, because G=
PG tends to lock the access to the card for itself full time, but I can han=
dle that by manualy terminating scdaemon.</div><div><br></div><div>But I ha=
ve also come across the opossite situation many times - something locks acc=
ess to the card via pkcs11 which prevents the access from scdaemon with the=
 dreaded &quot;PC/SC OPEN failed: sharing violation&quot;. The problem is t=
hat I don&#39;t know which process is using the card so I don&#39;t know ho=
w to deal with it except for restarting the whole pcscd. Also this problem =
seems to happen randomly so I don&#39;t have any clue if it&#39;s pam modul=
e or ssh agent or something else and it also randomly disappears. If I know=
 what is using the card, I could try to configure it better or deal with it=
 more gently.</div><div><br></div><div>And that&#39;s my question - how to =
find out what is currently accessing/locking the card at a given time? I tr=
ied to figure it out myself, but after I have seen this schema=C2=A0<a href=
=3D"https://blog.flameeyes.eu/2011/04/additional-notes-about-the-smartcard-=
components-diagram/" target=3D"_blank">https://blog.flameeyes.<wbr>eu/2011/=
04/additional-notes-ab<wbr>out-the-smartcard-components-<wbr>diagram/</a> I=
 realized that I don&#39;t even know at which level I should look for that =
information.<br></div></div></blockquote></span></div><br></div><div class=
=3D"gmail_extra">I just wrote a script for you.<br><a href=3D"https://githu=
b.com/LudovicRousseau/contrib/blob/master/list_pcsc_applications.sh" target=
=3D"_blank">https://github.com/<wbr>LudovicRousseau/contrib/blob/<wbr>maste=
r/list_pcsc_applications.<wbr>sh</a><br></div><div class=3D"gmail_extra"><b=
r></div><div class=3D"gmail_extra">Please tell me if it works for you or if=
 you need something different.<br><br></div><div class=3D"gmail_extra">Bye<=
span class=3D"HOEnZb"><font color=3D"#888888"><br clear=3D"all"></font></sp=
an></div><span class=3D"HOEnZb"><font color=3D"#888888"><div class=3D"gmail=
_extra"><br>-- <br><div class=3D"m_-8123142479502014381gmail_signature">=C2=
=A0Dr. Ludovic Rousseau</div>
</div></font></span></div>
<br>______________________________<wbr>_________________<br>
Pcsclite-muscle mailing list<br>
<a href=3D"mailto:[email protected]">Pcsclite-muscle@=
lists.alioth.<wbr>debian.org</a><br>
<a href=3D"http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/pcsclite=
-muscle" rel=3D"noreferrer" target=3D"_blank">http://lists.alioth.debian.<w=
br>org/cgi-bin/mailman/listinfo/<wbr>pcsclite-muscle</a><br></blockquote></=
div><br><br clear=3D"all"><div><br></div>-- <br><div class=3D"gmail_signatu=
re" data-smartmail=3D"gmail_signature">Franti=C5=A1ek<br><a href=3D"http://=
calavera.info/" target=3D"_blank">http://calavera.info/</a></div>
</div>

--94eb2c06ed9aabce8e055c46b967--


--===============4049525862459222626==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Pcsclite-muscle mailing list
[email protected]
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/pcsclite-muscle
--===============4049525862459222626==--