shaba/systemd
1
0
Fork 0
mirror of https://github.com/systemd/systemd.git synced 2025-03-01 08:58:29 +03:00
Code
systemd/rules.d/60-fido-id.rules

15 lines
491 B
Plaintext
Raw Normal View History

udev: Add id program and rule for FIDO security tokens Add a fido_id program meant to be run for devices in the hidraw subsystem via an IMPORT directive. The program parses the HID report descriptor and assigns the ID_SECURITY_TOKEN environment variable if a declared usage matches the FIDO_CTAPHID_USAGE declared in the FIDO CTAP specification. This replaces the previous approach of whitelisting all known security token models manually. This commit is accompanied by a test suite and a fuzzer target for the descriptor parsing routine. Fixes: #11996.
2019-08-21 11:17:59 +02:00
# do not edit this file, it will be overwritten on update
ACTION=="remove", GOTO="fido_id_end"
SUBSYSTEM=="hidraw", IMPORT{program}="fido_id"
udev: mark all ccid/security devices with a special tag This adds a udev tag that is supposed to be attached to all devices that might potentially expose a PKCS#11 slot, i.e. CCID smartcards and similar. We can then use the appearance of devices of this type as trigger to rescan PKCS#11 slots.
2019-11-05 16:42:57 +01:00
# Tag any form of security token as such
ENV{ID_SECURITY_TOKEN}=="1", TAG+="security-device"
rules: Move ID_SMARTCARD_READER definition to a <70 configuration. 70-uaccess.rules sets the uaccess tag on devices with ID_SMARTCARD_READER set, but it is set in 99-systemd.rules . Move this to a 60-*.rules which already matches USB CCID class, factorising the matching, so 70-uaccess.rules sets up these devices as expected.
2021-02-27 00:17:06 +00:00
SUBSYSTEM=="usb", ENV{DEVTYPE}=="usb_device", ENV{ID_USB_INTERFACES}=="*:0b????:*", ENV{ID_SMARTCARD_READER}="1"
udev: mark all ccid/security devices with a special tag This adds a udev tag that is supposed to be attached to all devices that might potentially expose a PKCS#11 slot, i.e. CCID smartcards and similar. We can then use the appearance of devices of this type as trigger to rescan PKCS#11 slots.
2019-11-05 16:42:57 +01:00
# Tag any CCID device (i.e. Smartcard Reader) as security token
rules: Move ID_SMARTCARD_READER definition to a <70 configuration. 70-uaccess.rules sets the uaccess tag on devices with ID_SMARTCARD_READER set, but it is set in 99-systemd.rules . Move this to a 60-*.rules which already matches USB CCID class, factorising the matching, so 70-uaccess.rules sets up these devices as expected.
2021-02-27 00:17:06 +00:00
ENV{ID_SMARTCARD_READER}=="1", TAG+="security-device"
udev: mark all ccid/security devices with a special tag This adds a udev tag that is supposed to be attached to all devices that might potentially expose a PKCS#11 slot, i.e. CCID smartcards and similar. We can then use the appearance of devices of this type as trigger to rescan PKCS#11 slots.
2019-11-05 16:42:57 +01:00
udev: Add id program and rule for FIDO security tokens Add a fido_id program meant to be run for devices in the hidraw subsystem via an IMPORT directive. The program parses the HID report descriptor and assigns the ID_SECURITY_TOKEN environment variable if a declared usage matches the FIDO_CTAPHID_USAGE declared in the FIDO CTAP specification. This replaces the previous approach of whitelisting all known security token models manually. This commit is accompanied by a test suite and a fuzzer target for the descriptor parsing routine. Fixes: #11996.
2019-08-21 11:17:59 +02:00
LABEL="fido_id_end"
Copy Permalink