Re: how to pledge(2) for Yubikey

2020-07-21 Thread Demi M. Obenour
On 2020-07-14 12:58, Stuart Henderson wrote: > Known problem, there's no nice way around it though. The standard model > used on most OS of controlling many simpler USB devices from a low > privileged userland process does not work too well with the approach > in https://cvsweb.openbsd.org/src/etc/

Re: how to pledge(2) for Yubikey

2020-07-14 Thread Theo de Raadt
Stuart Henderson wrote: > > I don't know if this matters, but for even ykinfo(1) (in the ykpers port) > > to work, I had to: > > # chmod g+w /dev/usb1 > > # chmod g+rw /dev/ugen0.00 > > Known problem, there's no nice way around it though. The standard model > used on most OS of controlling many

Re: how to pledge(2) for Yubikey

2020-07-14 Thread Stuart Henderson
On 2020-07-14, Lévai Dániel wrote: > I'm trying to implement pledge(2) support into kc(1) (in ports) while using > it with a Yubikey. > So far this is my pledge string: > char*pledges = "cpath exec fattr flock proc rpath stdio tty unix > wpath"; > > This covers everything it would d

Re: how to pledge(2) for Yubikey

2020-07-14 Thread Theo de Raadt
That is never going to work. We will never permit raw access to usb devices like that, in fact we are headed completely the other direction with /dev/fido support hiding the complexity. =?utf-8?Q?L=C3=A9vai=2C_D=C3=A1niel?= wrote: > Hi all! > > I'm trying to implement pledge(2) support into kc

how to pledge(2) for Yubikey

2020-07-14 Thread Lévai , Dániel
Hi all! I'm trying to implement pledge(2) support into kc(1) (in ports) while using it with a Yubikey. So far this is my pledge string: char*pledges = "cpath exec fattr flock proc rpath stdio tty unix wpath"; This covers everything it would do without the Yubikey. But I can't seem t