Re: sys-apps/pcsc-lite needs to access /sys

On Sun, 9 Feb 2014 13:43:29 +0100
Sven Vermeulen <[email protected]> wrote:

> Isn't there any mount option that you can pass so that all members of
> a certain group can still access sysfs? Perhaps "gid="?

I guess that would be a safer approach. But I'd prefer a standardized
approach for this - surely there are more non-root applications which
need extended /sys access. I think not every hardened user should have
to figure this out himself.

The best way I can imagine to solve this would be a new eclass. It
would be called in an ebuild (unconditionally) with an user name, would
then check if a certain USE flag (either "hardened" or something more
specific) was set and then add the user in question to a certain group,
perhaps "sysfs". Before doing this for the first time, it would create
that group and ask the user to add an appropriate mount option.

What do you think about this? Is it just overcomplicated or a good way
to go? Also, do you know of other programs which have problems with
GRKERNSEC_SYSFS_RESTRICT? I'd be willing to write the eclass if you
like the idea.


Regards,
Luis Ressel

--
Luis Ressel <[email protected]>
GPG fpr: F08D 2AF6 655E 25DE 52BC  E53D 08F5 7F90 3029 B5BD

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.22 (GNU/Linux)

iQJ8BAEBCgBmBQJS935XXxSAAAAAAC4AKGlzc3Vlci1mcHJAbm90YXRpb25zLm9w
ZW5wZ3AuZmlmdGhob3JzZW1hbi5uZXRBMjU3MDBFQTc5QkYzMkY4NEQzMTFGNDlD
NzE4OTFBNkEwRUZCN0U5AAoJEMcYkaag77fpN/8P/ikDBllo88Fj1w8a6zocm/fw
DAgZCM3AjBecEMi7Su8x5TtlS5rWtfDmwyk/EXgCTcs9SJXAuSKQ6uA8GrzzH9WM
jaCh5QLA+hrX9MKO2u+ooooBQVztgJdTkU/jZtiqrbuLCJhRKly0rBN1E2KFRemJ
fsuXab0b7nNiO/dvurL4zanfla0feNWOn050+8UlXjipChMng+7WFtCyW6QH+Yba
lcwSxWkDbdwfdOxXjjNLutN6q2hVWjuH4eRaMhJcMHn8GHJ4chN7QokFUyXVd0zX
AswQsUtt24fRIzYU0OFJOgwnZe+9xrq8+qIetWmzVbfdK1cjKfAsNh5nGbOXkFkY
55xck0fIXy8P1In2ewomW22jB1r65r7RWWkTvfWb/3OGF6t8osySJqgw2Scf4KXp
U6gXsOr3HYwr0uT9vfUwhQsmRJ3CAJzXce/Ur97lv4xZl9ZSHe+9oLfXM5AvdUrL
87BhNGkrHeHkozhMpLhTorbRcYH6PZ+h3eUUbtfdYVxzr4hoOAxjKIphjFG8fASp
tN1/wN+B2euZACYfi8HIG70G4iL+pVRB4YQt7w8Y/tjX6M9m7kpGnEtYqzE4dxSg
Hj7jCQu5hj0aDWvsMkHZMamG+YLsn1Ks9LL0LasOqINUpuLz3R7G0yXFZQPL8fEY
b7PFvJYozMAvAvb4fG9B
=Fm1i
-----END PGP SIGNATURE-----