Re: using polkit

Hello,

2013/12/18 Nikos Mavrogiannopoulos <[email protected]>:
> On Tue, 2013-12-17 at 16:41 +0100, Nikos Mavrogiannopoulos wrote:
>> Hello,
>>  This patch adds polkit [0] support to pcscd, if the --with-polkit
>> configure option is specified. That allows more fine grained access
>> control to smart cards (e.g., only console users can access the card
>> and so on). It is a preliminary patch and the pcscd option with
>> very crude access control (allowed to access or not).  Please let me
>> know of any comments.
>
> The attached patch provides more fine-grained access control. It splits
> the access control to PCSC daemon access, and smart card access. The
> latter can even be restricted with a polkit ruleset to specific smart cards.

Some remarks on the patch:
- maybe you should use "org.debian.alioth.pcsc-lite.foobar" instead of
"org.debian.pcsc-lite.foobar" (with alioth added)
- if the client is not authorized you do not return an error code to
the client. The daemon just closes the communication. This will make
debuging difficult. It would be better to return a specific error to
the client application. But such an error is not (yet) defined by
PC/SC

General remarks:
- do you have a configuration file? Is doc/org.debian.pcsc-lite.policy
the default configuration file?
- where can I find documentation about the configuration file?
- how to restrict the access to only specific applications (or processes)?
So more documentation is needed (at least pointers to existing documentation).

On more fundamental question: PC/SC can be used in a PAM module so
_before_ the user is authenticated. How is it supposed to work with a
policy kit configuration that only allows authenticated users?

Regards,

-- 
 Dr. Ludovic Rousseau