[gentoo-hardened] sys-apps/pcsc-lite needs to access /sys

2014-02-09 Thread Luis Ressel
Hello, I'm currently experimenting with OpenPGP smartcards. For those, I need sys-apps/pcsc-lite, which features a daemon (pcscd). This daemon has its own user and doesn't run with root permissions. However, it needs to access some files in /sys which are only accessible by root due to GRKERNSEC_

Re: [gentoo-hardened] sys-apps/pcsc-lite needs to access /sys

2014-02-09 Thread Sven Vermeulen
Isn't there any mount option that you can pass so that all members of a certain group can still access sysfs? Perhaps "gid="? Wkr, Sven Vermeulen On Sun, Feb 9, 2014 at 1:35 PM, Luis Ressel wrote: > Hello, > > > I'm currently experimenting with OpenPGP smartcards. For those, I > need sys-apps/

Re: [gentoo-hardened] sys-apps/pcsc-lite needs to access /sys

2014-02-09 Thread Luis Ressel
On Sun, 9 Feb 2014 13:43:29 +0100 Sven Vermeulen wrote: > Isn't there any mount option that you can pass so that all members of > a certain group can still access sysfs? Perhaps "gid="? I guess that would be a safer approach. But I'd prefer a standardized approach for this - surely there are mor

Re: [gentoo-hardened] sys-apps/pcsc-lite needs to access /sys

2014-02-09 Thread Sven Vermeulen
On Sun, Feb 09, 2014 at 02:10:47PM +0100, Luis Ressel wrote: > > Isn't there any mount option that you can pass so that all members of > > a certain group can still access sysfs? Perhaps "gid="? > > I guess that would be a safer approach. But I'd prefer a standardized > approach for this - surely

Re: [gentoo-hardened] sys-apps/pcsc-lite needs to access /sys

2014-02-09 Thread Luis Ressel
On Sun, 9 Feb 2014 15:47:59 +0100 Sven Vermeulen wrote: > After all, it might be as simple as: > > #v+ > use hardened && egroupadd sysfs > #v- > > if egroupadd would exist, that is. I haven't looked in detail at the > user.eclass, but that would be all that is needed. There's no egroupadd, bu