Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.bugs.dist > #1178870 > unrolled thread

Bug#1058770: globalplatform: establish_context failed with error 0x8010006A (Access denied.)

Back to article view | Back to linux.debian.bugs.dist

Contents

  Bug#1058770: globalplatform: establish_context failed with error 0x8010006A (Access denied.) Ludovic Rousseau <rousseau@debian.org> - 2023-12-15 23:20 +0100
    Bug#1058770: globalplatform: establish_context failed with error 0x8010006A (Access denied.) Ludovic Rousseau <ludovic.rousseau@free.fr> - 2023-12-16 12:20 +0100
      Bug#1058770: globalplatform: establish_context failed with error 0x8010006A (Access denied.) Simon Josefsson <simon@josefsson.org> - 2023-12-16 19:50 +0100

#1178870 — Bug#1058770: globalplatform: establish_context failed with error 0x8010006A (Access denied.)

Source: globalplatform
Version: 2.3.1+dfsg-3
Severity: normal

Dear Maintainer,

The package has some autopkgtests in debian/tests/ that now fail with
pcsc-lite 2.0.1.

The tests in globalplatform create a regression and prevent pcsc-lite
2.0.1 to migrate from unstable to testing.

For example see https://ci.debian.net/packages/g/globalplatform/testing/ppc64el/40915103/#S8

 43s autopkgtest [04:47:35]: test cli: [-----------------------
 43s enable_trace
 43s establish_context
 43s establish_context failed with error 0x8010006A (Access denied.)
 44s autopkgtest [04:47:36]: test cli: -----------------------]
 44s cli                  FAIL non-zero exit status 1

This is because pcsc-lite 2.0.1 now enables polkit by default.
See https://blog.apdu.fr/posts/2023/11/new-version-of-pcsc-lite-201/
and https://blog.apdu.fr/posts/2023/11/pcsc-lite-and-polkit/

It looks like the way the autopkgtest environment is set makes pcscd to
consider the connection is not local.
Since no user session is started polkit is not configured correctly.


Is it possible to modify the tests in globalplatform so that the error
0x8010006A is NOT considered as a failure?
I am trying to find a long term solution in pcsc-lite.

Thanks

-- System Information:
Debian Release: trixie/sid
  APT prefers testing
  APT policy: (500, 'testing')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 6.5.0-5-amd64 (SMP w/12 CPU threads; PREEMPT)
Locale: LANG=fr_FR.UTF-8, LC_CTYPE=fr_FR.UTF-8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

[toc] | [next] | [standalone]

#1178902

On Fri, 15 Dec 2023 22:29:46 +0100 Ludovic Rousseau <rousseau@debian.org> wrote:
> Is it possible to modify the tests in globalplatform so that the error
> 0x8010006A is NOT considered as a failure?

No need to disable your tests. I found the solution.

> I am trying to find a long term solution in pcsc-lite.

The idea is to start pcscd with polkit disabled.

In debian/tests/control you add (for both tests):
Restrictions: needs-sudo

In your test files cli and lib you add:
# setup pcscd with NO polkit control to avoid " Access denied." errors
echo "PCSCD_ARGS=--disable-polkit" | sudo tee /etc/default/pcscd
sudo systemctl restart pcscd.service



Proposed patch:
diff --git a/debian/tests/cli b/debian/tests/cli
index 298088b..1e19f2a 100755
--- a/debian/tests/cli
+++ b/debian/tests/cli
@@ -2,6 +2,10 @@
 
 set -e
 
+# setup pcscd with NO polkit control to avoid " Access denied." errors
+echo "PCSCD_ARGS=--disable-polkit" | sudo tee /etc/default/pcscd
+sudo systemctl restart pcscd.service
+
 cat<<EOF | gpshell
 enable_trace
 establish_context
diff --git a/debian/tests/control b/debian/tests/control
index 63b632f..250c457 100644
--- a/debian/tests/control
+++ b/debian/tests/control
@@ -3,6 +3,7 @@ Depends:
  gpshell,
  libgppcscconnectionplugin1,
  pcscd,
+Restrictions: needs-sudo
 
 Tests: lib
 Depends:
@@ -13,3 +14,4 @@ Depends:
  libssl-dev,
  pcscd,
  pkgconf,
+Restrictions: needs-sudo
diff --git a/debian/tests/lib b/debian/tests/lib
index 18aad32..7597c33 100755
--- a/debian/tests/lib
+++ b/debian/tests/lib
@@ -2,6 +2,10 @@
 
 set -e
 
+# setup pcscd with NO polkit control to avoid " Access denied." errors
+echo "PCSCD_ARGS=--disable-polkit" | sudo tee /etc/default/pcscd
+sudo systemctl restart pcscd.service
+
 dir=`dirname "$0"`
 
 # change directory to $AUTOPKGTEST_TMP if available



I can push this patch in salsa and close this bug if you want.
Just tell me.

[toc] | [prev] | [next] | [standalone]

#1178931

[Multipart message — attachments visible in raw view] — view raw

Ludovic Rousseau <ludovic.rousseau@free.fr> writes:

>> I am trying to find a long term solution in pcsc-lite.
>
> The idea is to start pcscd with polkit disabled.

Thanks -- I was just experimenting with solutions based on
/usr/share/polkit-1/rules.d/ after reading
https://blog.apdu.fr/posts/2023/11/pcsc-lite-and-polkit/ but I'm not
able to get anything but PCSCD_ARGS=--disable-polkit to work.  Do I need
to restart something to get pcscd to re-read the polkit files?

> I can push this patch in salsa and close this bug if you want.
> Just tell me.

Please open a merge request on Salsa and I will review, merge and do a
new upload.

/Simon

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.bugs.dist

csiph-web