Chapter 5. Controlling access to smart cards by using polkit To cover possible threats that cannot be prevented by mechanisms built into smart cards, such as PINs, PIN pads, and biometrics, and for more fine-grained control, RHEL uses the polkit framework for controlling access control to smart cards. System administrators can configure polkit to fit specific scenarios, such as smart-card access for non-privileged or non-local users or services. 5.1. Smart-card access control through polkit The Personal Computer/Smart Card (PC/SC) protocol specifies a standard for integrating smart cards and their readers into computing systems. In RHEL, the pcsc-lite package provides middleware to access smart cards that use the PC/SC API. A part of this package, the pcscd (PC/SC Smart Card) daemon, ensures that the system can access a smart card using the PC/SC protocol. Because access-control mechanisms built into smart cards, such as PINs, PIN pads, and biometrics, do not cover all possible threats, RHEL uses the polkit framework for more robust access control. The polkit authorization manager can grant access to privileged operations. In addition to granting access to disks, you can use polkit also to specify policies for securing smart cards. For example, you can define which users can perform which operations with a smart card. After installing the pcsc-lite package and starting the pcscd daemon, the system enforces policies defined in the /usr/share/polkit-1/actions/ directory. The default system-wide policy is in the /usr/share/polkit-1/actions/org.debian.pcsc-lite.policy file. Polkit policy files use the XML format and the syntax is described in the polkit(8) man page on your system. The polkitd service monitors the /etc/polkit-1/rules.d/ and /usr/share/polkit-1/rules.d/ directories for any changes in rule files stored in these directories. The files contain authorization rules in JavaScript format. System administrators can add custom rule files in both directories, and polkitd reads them in lexical order based on their file name. If two files have the same names, then the file in /etc/polkit-1/rules.d/ is read first. If you need to enable smart-card support when the system security services daemon (SSSD) does not run as root , you must install the sssd-polkit-rules package. The package provides polkit integration with SSSD. Additional resources polkit(8) , polkitd(8) , and pcscd(8) man pages on your system 5.2. Troubleshooting problems related to PC/SC and polkit Polkit policies that are automatically enforced after you install the pcsc-lite package and start the pcscd daemon may ask for authentication in the user's session even if the user does not directly interact with a smart card. In GNOME, you can see the following error message: Note that the system can install the pcsc-lite package as a dependency when you install other packages related to smart cards such as opensc . If your scenario does not require any interaction with smart cards and you want to prevent displaying authorization requests for the PC/SC daemon, you can remove the pcsc-lite package. Keeping the minimum of necessary packages is a good security practice anyway. If you use smart cards, start troubleshooting by checking the rules in the system-provided policy file at /usr/share/polkit-1/actions/org.debian.pcsc-lite.policy . You can add your custom rule files to the policy in the /etc/polkit-1/rules.d/ directory, for example, 03-allow-pcscd.rules . Note that the rule files use the JavaScript syntax, the policy file is in the XML format. To understand what authorization requests the system displays, check the Journal log, for example: The log entry means that the user is not authorized to perform an action by the policy. You can solve this denial by adding a corresponding rule to /etc/polkit-1/rules.d/ . You can search also for log entries related to the polkitd unit, for example: In the output, the first entry means that the rule file contains some syntax error. The second entry means that the user failed to gain the access to pcscd . You can also list all applications that use the PC/SC protocol by a short script. Create an executable file, for example, pcsc-apps.sh , and insert the following code: Run the script as root : Additional resources journalctl , polkit(8) , polkitd(8) , and pcscd(8) man pages. 5.3. Displaying more detailed information about polkit authorization to PC/SC In the default configuration, the polkit authorization framework sends only limited information to the Journal log. You can extend polkit log entries related to the PC/SC protocol by adding new rules. Prerequisites You have installed the pcsc-lite package on your system. The pcscd daemon is running. Procedure Create a new file in the /etc/polkit-1/rules.d/ directory: Edit the file in an editor of your choice, for example: Insert the following lines: Save the file, and exit the editor. Restart the pcscd and polkit services: Verification Make an authorization request for pcscd . For example, open the Firefox web browser or use the pkcs11-tool -L command provided by the opensc package. Display the extended log entries, for example: Additional resources polkit(8) and polkitd(8) man pages. 5.4. Additional resources Controlling access to smart cards Red Hat Blog article.

Commands:
Authentication is required to access the PC/SC daemon
journalctl -b | grep pcsc Process 3087 (user: 1001) is NOT authorized for action: access_pcsc
journalctl -u polkit polkitd[NNN]: Error compiling script /etc/polkit-1/rules.d/00-debug-pcscd.rules polkitd[NNN]: Operator of unix-session:c2 FAILED to authenticate to gain authorization for action org.debian.pcsc-lite.access_pcsc for unix-process:4800:14441 [/usr/libexec/gsd-smartcard] (owned by unix-user:group)
#!/bin/bash cd /proc for p in [0-9]* do if grep libpcsclite.so.1.0.0 USDp/maps &> /dev/null then echo -n "process: " cat USDp/cmdline echo " (USDp)" fi done
./pcsc-apps.sh process: /usr/libexec/gsd-smartcard (3048) enable-sync --auto-ssl-client-auth --enable-crashpad (4828)
touch /etc/polkit-1/rules.d/00-test.rules
vi /etc/polkit-1/rules.d/00-test.rules
polkit.addRule(function(action, subject) { if (action.id == "org.debian.pcsc-lite.access_pcsc" || action.id == "org.debian.pcsc-lite.access_card") { polkit.log("action=" + action); polkit.log("subject=" + subject); } });
systemctl restart pcscd.service pcscd.socket polkit.service
journalctl -u polkit --since "1 hour ago" polkitd[1224]: <no filename>:4: action=[Action id='org.debian.pcsc-lite.access_pcsc'] polkitd[1224]: <no filename>:5: subject=[Subject pid=2020481 user=user' groups=user,wheel,mock,wireshark seat=null session=null local=true active=true]