Auto connections for pcsc-daemon

pcsc-daemon is a snap that bundles the pcscd smartcard/NFC daemon from the pcsc-lite package, the matching library and the acsccid and ccid USB drvers into one snap.

To detect smartcard/NFC readers on USB the snap needs to be connected to the raw-usb and hardware-observe interfaces.

I’d like to request auto.connection for both of these interfaces.

Additionally pcsc-daemon also provides a content interface that gives connected snaps r/w access to the pcscd socket.
I’d like to request a store declaration for auto-connection of this interface for all possible consumers here as well (so snaps from other maintainers can use pcsc-daemon as default-provider and get the snap auto-installed)…

An example consumer snap can be found here:

with a snapcraft.yaml here:

1 Like

The use-cases for hardware-observe and raw-usb are expected for this snap, so +1 from me.

For the request for the auto-connect declaration for the content interface seems potentially problematic since this opens up this interface for potential attack from other untrusted snaps - so if pcsc-daemon were compromised by another snap, the other snap would then potentially have access to raw-usb by proxy - this seems a little worrying to me. Is the pcsc socket API robust against potential attack?

So whilst I think it makes sense for the pcsc-daemon snap to be the default provider of this slot, I feel this would be better to be granted as an auto-connect on the plug side (ie the snap that wishes to use this slot) rather than a blanket grant for any possible consumer snap. So -1 from me for an auto-connect declaration for the content interface providing the pcsc-daemon socket.

Can other @reviewers please vote and comment on this request?

+1 from me on auto connecting hardware-observe and raw-usb. Alex’s suggestion for plug-side connection of pcsc-daemon makes sense also.

1 Like

A community LGTM for me, pcscd is already available in the classic Linux distributions and it definitely helps Ubuntu Core devices for the functionalities it provides.

The socket usage seems sane to me as well as there are alot of applications that require access to pcscd for smart card authentication, etc.

1 Like

+1 from me on auto connecting hardware-observe and raw-usb. +3 votes for, 0 votes against. Granting auto-connect of hardware-observe and raw-usb to pcsc-daemon snap. This is now live.

@ogra, what do you think about @alexmurray suggestion about managing the auto-connection of the content interface on the plug-side instead?

1 Like

this is a fine fallback i can live with, thanks !