On Tue, Nov 17, 2015 at 03:44:03PM +0100, Sumit Bose wrote:
On Tue, Nov 17, 2015 at 01:56:01PM +0100, Jakub Hrozek wrote:
> On Tue, Nov 17, 2015 at 01:39:32PM +0100, Sumit Bose wrote:
> > > > diff --git a/Makefile.am b/Makefile.am
> > > > index
ee97d095e07f6d485232a1afd87f9e4057688f22..57bece64c5fca058dcf57efffb149770ac3b773e 100644
> > > > --- a/Makefile.am
> > > > +++ b/Makefile.am
> > > > @@ -150,6 +150,10 @@ sssdlibexec_PROGRAMS += selinux_child
> > > > endif
> > > > if HAVE_NSS
> > > > sssdlibexec_PROGRAMS += p11_child
> > > > +if SSSD_USER
> > > > +polkit_rulesdir = $(datadir)/polkit-1/rules.d
> > > > +dist_polkit_rules_DATA = contrib/sssd-pcsc.rules
> > >
> > > Since the polkit rules are something this patch uses undonditionally,
> >
> > what do you mean by 'unconditionally'?
>
> I meant regardless of what OS we are running on -- the OS might not support
> the newer javascript based polkit syntax. But if RHEL-6 supports it,
> then fine, it's the oldest OS we support.
Sorry for the delay, I thought I already replied to this patch..
I just check on RHEL-6. Since an older version of pcscd is used on
RHEL-6 which allows access to the Smartcard to any user no specific action is
needed here at all we can use run p11_child as any user. But of course
in this case we do not want to install the polkit rules files. If you
agree I'll add a %global which controls if the file is installed or not
and disable it on RHEL6 (and below :-).
Yes, please go ahead, then we can push the patch, I think.
The only thing to remember now is that if we hand out the upstream
packages, we need to make sure that /proc/sys/fs/suid_dumpable is set to
2 if we ask people to collect corefiles. But since the audience of
upstream packages is typically limited and we ask people to run them, I
think it's OK.