Repository: sosreport/sos

Issue:
smartcard plugin is using tools removed/not available from rhel8 and newer
The pam_pkcs11 was last available in RHEL7 and is no longer available in RHEL8 and newer so there is no point for checking it and its configuration files in:

https://github.com/sosreport/sos/blob/b96926f151da984491de3082af7d06ecb07fc517/sos/report/plugins/smartcard.py#L21-L22

The `pcsc-tools` package above is not available in RHEL (only from EPEL). Instead, this list should contain `pcsc-lite` and `pcsc-lite-ccid` packages.

Also the following commands/path do not have any significance so I propose to remove them (the `pklogin_finder` is part of pam_pkcs11`, which is not available in RHEL8 and newer). The respective replacement would be some command from sssd, but most of the sssd logs are already collected so I do not think we need a separate command:

https://github.com/sosreport/sos/blob/b96926f151da984491de3082af7d06ecb07fc517/sos/report/plugins/smartcard.py#L32-L33
https://github.com/sosreport/sos/blob/b96926f151da984491de3082af7d06ecb07fc517/sos/report/plugins/smartcard.py#L40

The `pcsc_scan` is a tool that is shipped in `pcsc-tools` package, which is available in EPEL only so I suggest to remove it:

https://github.com/sosreport/sos/blob/b96926f151da984491de3082af7d06ecb07fc517/sos/report/plugins/smartcard.py#L34

Let me know if this sounds ok to you or I should open a PR with the proposed changes.

Note, that these are still needed for RHEL7, but I think for RHEL7 you have a different branch.


Discussion:
> The pam_pkcs11 was last available in RHEL7 and is no longer available in RHEL8 and newer so there is no point for checking it and its configuration files in:
> 
> https://github.com/sosreport/sos/blob/b96926f151da984491de3082af7d06ecb07fc517/sos/report/plugins/smartcard.py#L21-L22

It still does make sense to have it there for legacy reasons, if upstream ;sos; is run on RHEL7. Anyway, we dont have a strict policy how far to the past the legacy reason applies..

> 
> The `pcsc-tools` package above is not available in RHEL (only from EPEL). Instead, this list should contain `pcsc-lite` and `pcsc-lite-ccid` packages.

Likewise above, we shall keep the `pcsc-tools` for some time, yet. Surely we should enhance the list by the two packages.

> 
> Also the following commands/path do not have any significance so I propose to remove them (the `pklogin_finder` is part of pam_pkcs11`, which is not available in RHEL8 and newer). The respective replacement would be some command from sssd, but most of the sssd logs are already collected so I do not think we need a separate command:
> 
> https://github.com/sosreport/sos/blob/b96926f151da984491de3082af7d06ecb07fc517/sos/report/plugins/smartcard.py#L32-L33

Ditto above. Collecting files that dont exist is quick and safe. (but again: we should have some generic policy for such removals (not having it now) and follow it).

> The `pcsc_scan` is a tool that is shipped in `pcsc-tools` package, which is available in EPEL only so I suggest to remove it:
> 
> https://github.com/sosreport/sos/blob/b96926f151da984491de3082af7d06ecb07fc517/sos/report/plugins/smartcard.py#L34
> 
> Let me know if this sounds ok to you or I should open a PR with the proposed changes.

I would just add the two packages to `packages` list but not strong objection in either removal. Is there something *new* to collect, also?


> 
> Note, that these are still needed for RHEL7, but I think for RHEL7 you have a different branch.

It is rather a `python-2` specific branch for systems where `python-3` is not the default Python version. Which is e.g. RHEL7, indeed :).

Resolving patch:
diff --git a/sos/report/plugins/smartcard.py b/sos/report/plugins/smartcard.py
--- a/sos/report/plugins/smartcard.py
+++ b/sos/report/plugins/smartcard.py
@@ -19,14 +19,18 @@ class Smartcard(Plugin, RedHatPlugin):
     profiles = ('security', 'identity', 'hardware')
 
     files = ('/etc/pam_pkcs11/pam_pkcs11.conf',)
-    packages = ('pam_pkcs11', 'pcsc-tools', 'opensc')
+    # The pam_pkcs11 is available only in RHEL7
+    packages = ('pam_pkcs11', 'pcsc-tools', 'opensc', 'pcsc-lite',
+                'pcsc-lite-ccid')
 
     def setup(self):
         self.add_copy_spec([
             "/etc/reader.conf",
             "/etc/reader.conf.d/",
             "/etc/pam_pkcs11/",
-            "/etc/opensc-*.conf"
+            "/etc/opensc-*.conf",
+            "/etc/pkcs11/modules/*.module",
+            "/usr/share/p11-kit/modules/*.module"
         ])
         self.add_cmd_output([
             "pklogin_finder debug",


Test patch: