Re: sys-apps/pcsc-lite needs to access /sys

On Sun, 9 Feb 2014 15:47:59 +0100
Sven Vermeulen <[email protected]> wrote:

> After all, it might be as simple as:
> 
> #v+
> use hardened && egroupadd sysfs <username>
> #v-
> 
> if egroupadd would exist, that is. I haven't looked in detail at the
> user.eclass, but that would be all that is needed.

There's no egroupadd, but it's possible to specify additional groups in
a enewuser call. The eclass-less approach would therefore be:

pkg_setup() {
    local hardened_group=""
    if use hardened ; then
        enewgroup sysfs
        hardened_group=",sysfs"
    fi

    enewgroup pcscd
    enewuser pcscd -1 -1 /run/pcscd pcscd${hardened_group}
}

However, the eclass would have the advantages:
* single point to rename group or use flag if neccessary
* ability to notify the user about the whole thing and ask him to add
   proper mount options

If the eclass approach is accepted, I'd propose to name the eclass
"hardened-utils" - perhaps we need other small helper functions like
this one in the future.


> But again, I think this needs to stage a bit - document it on the
> wiki, test it out. See if applications still work if they are member
> of said group without that group being the primary group, etc.

I'll do that.


Regards,
Luis Ressel

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.22 (GNU/Linux)

iQJ8BAEBCgBmBQJS95v0XxSAAAAAAC4AKGlzc3Vlci1mcHJAbm90YXRpb25zLm9w
ZW5wZ3AuZmlmdGhob3JzZW1hbi5uZXRBMjU3MDBFQTc5QkYzMkY4NEQzMTFGNDlD
NzE4OTFBNkEwRUZCN0U5AAoJEMcYkaag77fpBxwP/0zCtxbvhxo0VmPETgyOQr1e
UAz78UyCyIoS+qWjHQxQA4uVsK6JjK7BjVKPvxPj3hoikV+xUDLz3XYAbfe4M6pS
xCjnEt4K57Guqj9gtTatyC+lNgraV2xriXv/ax4BSyBLnE3CqIq9mIWjCBcPONvS
nwWshTXwbekulEN/dAS4W0cOIYIciPUDzgVz3EsMNTSndYFTylx+gdsF4Ihu6o7i
8B7FeNoNnqoXp7Pk8wqzrcP/sNLXzHUETT4CoFDxiOUp4hVp7NraWyByHV0hTNij
E8G3BSgiqX0NnfRdizy5g8oTMKmPKVxu6eyPNVpyogl41k7IVYyBSVD9wuIOPEHV
O/OjrG+OQoo6/0o50KRCdbnR+hFOHHp+wBSUwLCcmFRUZwdZHxCP5Omtz6S+L4O1
1v29sgOtSfmakpByCFZL12W9Bz0Sd5wYGAjIezD/LTjs8UyuCgRyNQXk2Anq0jeH
8V4l3WBi25xlLtrjIDJiBCsQWS7eIk9rLXEhX7ZVJdVM2XhdOoh0nJsV2P/4I4Eu
KnbJ6d//OL0zXU/NcgaJ8hAktL+oUiAJhSowOox6p8O2ilxrAQczoF0nNu5xxtlO
iupnFSWvhyn5rPDC/42ReSW5U+bp2idoxVwUfrOCuBlHkJtNkMNoRWI3JCe3+W8o
1D/sn/7ysxlENXdkk8Gh
=mZdS
-----END PGP SIGNATURE-----