Re: using polkit

On Sat, 2013-12-21 at 13:00 +0100, Ludovic Rousseau wrote:

> > The attached patch provides more fine-grained access control. It splits
> > the access control to PCSC daemon access, and smart card access. The
> > latter can even be restricted with a polkit ruleset to specific smart cards.
> Some remarks on the patch:
> - maybe you should use "org.debian.alioth.pcsc-lite.foobar" instead of
> "org.debian.pcsc-lite.foobar" (with alioth added)

Hello,
 About the name, I pretty much agree with Martin, and my concern was
whether debian would rename alioth at some point. That's why I didn't
use it. I can add it though if you think it should be there.

> - if the client is not authorized you do not return an error code to
> the client. The daemon just closes the communication. This will make
> debuging difficult. It would be better to return a specific error to
> the client application. But such an error is not (yet) defined by
> PC/SC

I'm not aware of the PC/SC protocol. What would you suggest here? Could
it be a pcsc-lite specific error code?

> General remarks:
> - do you have a configuration file? Is doc/org.debian.pcsc-lite.policy
> the default configuration file?

It is a reasonable default. It has to be copied
to /usr/share/polkit-1/actions/

> - where can I find documentation about the configuration file?

Polkit documentation isn't very verbose. It is documented at:
http://www.freedesktop.org/software/polkit/docs/latest/polkit.8.html

> - how to restrict the access to only specific applications (or processes)?
> So more documentation is needed (at least pointers to existing documentation).

As I understand that can be done using rules. I could not find out any
documentation for rules, but they are javascript files placed
in /usr/share/polkit-1/rules.d/

The rules for a specific smart card to be accessible by the web server
(run as httpd user) could be:

polkit.addRule(function(action, subject) {
    if (action.id == "org.debian.alioth.pcsc-lite.access_card" &&
        action._detail_reader == "name of reader" &&
        subject.user == "httpd" && subject.local == true) {
            return polkit.Result.YES;
    }
});

polkit.addRule(function(action, subject) {
    if (action.id == "org.debian.alioth.pcsc-lite.access_pcsc" &&
        subject.user == "httpd" && subject.local == true) {
            return polkit.Result.YES;
    }
});

> On more fundamental question: PC/SC can be used in a PAM module so
> _before_ the user is authenticated. How is it supposed to work with a
> policy kit configuration that only allows authenticated users?

PAM is executed with root privileges so I don't think that this part
could be affected by polkit (at least not by the default configuration I
included).

regards,
Nikos