From nobody Wed Sep 04 23:14:56 2024 X-Original-To: freebsd-security@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4Wzdcg0zfKz5VZck for ; Wed, 04 Sep 2024 23:14:59 +0000 (UTC) (envelope-from kevans@FreeBSD.org) Received: from smtp.freebsd.org (smtp.freebsd.org [IPv6:2610:1c1:1:606c::24b:4]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "smtp.freebsd.org", Issuer "R10" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4Wzdcg0CYFz40Mf for ; Wed, 4 Sep 2024 23:14:59 +0000 (UTC) (envelope-from kevans@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1725491699; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=4ei5kmAYMbzLOmkKScEtRXU8/57P8A2eDzp4mEyTI2A=; b=effhXA2i1jO8rIbYhpL5yMeeCbg5a1+MI/A4ovdQ9u08+3DtV0jTpAl4+sL3oAnktBA3Zg LX6MGqr3u4cTqhqO20rQXFp+gmMkup+xHF+KXXU00ueZpvBci60D+UzbGgcsqm9M2lYx/V +56+4U0HU5mmqnEfHRNwLVG50n3kwzx+Yt+2r/IXtF3UTbEm7gvdWZvDXMr9SwQ0mv5aGf dL/gEQCwtagZNCphM2di80ESZVvdtq4Kiapcmk899ASJW9NDh/Hv08Mj+GjTjub3uE31R6 JP3yUUCBYSjmq+m+VxSwEr1z8HbsRLlEwl5+TsMIZgYX6J9+BRjyMlrcYZLdWg== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1725491699; a=rsa-sha256; cv=none; b=X8SGLUMoHcpbUx+LE02hHAePDe0ONpzjpTSHmiDmDyAy0UWxbf/qRmLnTbImnK58ltlEnI /sAnavUc07yK4Gbw0KWdanW8lBrLqUcg2NJhYkXX8orsizgDX8Lxh0aRoqCYgwOSLtRahH TtXuE42iKAaBsrYIkxSehvVoGbNvU+KsVu7z1+e427+Ql27luvzw+kAs54VyWsS4144lzL lwUh3165b8MF0RT764CGHkT2p+CTNitqAIkFPio+VIyS3sc/AMZ36GNd9U94TTINV2/x/M aEjM9zbXJxH4ohuclAq+q6+DqODsLsgSOFgvBSUxs59Er58b1SqfxD0wCnVVLg== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1725491699; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=4ei5kmAYMbzLOmkKScEtRXU8/57P8A2eDzp4mEyTI2A=; b=vyjKHKVOPr7sSTrz1XZnamFhx7DGmD1rH2x2rd1Z+UjoPajG/+mIsGW8j6AmX+eKfcCp7a lg9sSP5RkAYlnvGqc8IO4/ySNDbULYT7HveVFOlOdDJbbqgC8ct7qqf1TOTeqv0flLDHFK hFF/4S2MCOTttXvMdkFiSXc0yNocMwm+uM6Qs+fHs+/rFZe1wMXowNbSCY25KJyg03u9wI GcGFSMV3htSmCP5MGzlIm81hvdyQUzKExJUQiiaUW92R5II/BBmqjLs9xrOxHTd7ZNa2wh ceU/OQjSenycU7/U6eT4ma39QLxVf8mg63kXgCuaxZJSjeyYz5hOTuTm89rkMg== Received: from [10.9.4.95] (unknown [209.182.120.176]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) (Authenticated sender: kevans/mail) by smtp.freebsd.org (Postfix) with ESMTPSA id 4Wzdcf5T95zbsC for ; Wed, 4 Sep 2024 23:14:58 +0000 (UTC) (envelope-from kevans@FreeBSD.org) Message-ID: <92f328f3-0f74-441a-840b-fdc3ae71fe0b@FreeBSD.org> Date: Wed, 4 Sep 2024 18:14:56 -0500 List-Id: Security issues List-Archive: https://lists.freebsd.org/archives/freebsd-security List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: freebsd-security@freebsd.org Sender: owner-freebsd-security@FreeBSD.org MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: Privileges using security tokens through PC/SC-daemon To: freebsd-security@freebsd.org References: <20240904104147.8c1e74632b2c6d4f6a759ee6@magnetkern.de> <20240905005823.3f7aa990a66c5f40d4eb4a8b@magnetkern.de> Content-Language: en-US From: Kyle Evans In-Reply-To: <20240905005823.3f7aa990a66c5f40d4eb4a8b@magnetkern.de> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit On 9/4/24 17:58, Jan Behrens wrote: > I think I may have found the problem. If I'm right, it is an issue of > pcsc-lite in combination with FreeBSD. > > Looking into pcsc-lite's file "src/auth.c", we find: > > #if defined(HAVE_POLKIT) && defined(SO_PEERCRED) > ... > #else > unsigned IsClientAuthorized(int socket, const char* action, const char* reader) > { > (void)socket; > (void)action; > (void)reader; > > return 1; > } > > #endif > > See: > https://github.com/LudovicRousseau/PCSC/blob/da69dda356dc79300a997631f94efed7190d30a6/src/auth.c#L54 > > If I'm not mistaken, SO_PEERCRED is not set by the build system and it > is not defined on FreeBSD (but only on Linux). Then pcsc-lite defaults > to simply assume that any client is always authorized. Not good. > > I wasn't able to get the build working, so maybe someone can check if > my guess is correct. > > Kind regards, > Jan Behrens > Right, that'd be a problem. Something like this might work, but I haven't even build tested it: https://people.freebsd.org/~kevans/pcsc-auth.diff It could be cleaned up a little bit if it works. Thanks, Kyle Evans