Skip to content

Commit 7aed406

Browse files
committed
proxy: initial import
gnupg-pkcs11-scd-proxy is a set of two utilities a client and a server that can be used in order to load the gnupg-pkcs11-scd in a different security context. this is usable when PKCS#11 provider is to be isolated.
1 parent c7b2a88 commit 7aed406

10 files changed

+820
-4
lines changed

.gitignore

+4
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,10 @@ install-sh
2424
missing
2525
stamp-h1
2626

27+
gnupg-pkcs11-scd-proxy/gnupg-pkcs11-scd-proxy
28+
gnupg-pkcs11-scd-proxy/gnupg-pkcs11-scd-proxy-server
29+
gnupg-pkcs11-scd-proxy/gnupg-pkcs11-scd-proxy.service
30+
gnupg-pkcs11-scd-proxy/gnupg-pkcs11-scd-proxy.service.in
2731
gnupg-pkcs11-scd.spec
2832
gnupg-pkcs11-scd/gnupg-pkcs11-scd
2933

ChangeLog

+2
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,8 @@ Copyright (c) 2006-2017 Alon Bar-Lev <[email protected]>
66

77
* Avoid dup of stdin/stdout so that the terminate assuan hack operational
88
again.
9+
* Introduce gnupg-pkcs11-scd-proxy to allow isolation of the PKCS#11
10+
provider.
911

1012
2017-07-15 - Version 0.8.0
1113

Makefile.am

+1
Original file line numberDiff line numberDiff line change
@@ -45,6 +45,7 @@ MAINTAINERCLEANFILES = \
4545

4646
SUBDIRS = \
4747
gnupg-pkcs11-scd \
48+
gnupg-pkcs11-scd-proxy \
4849
distro \
4950
$(NULL)
5051

configure.ac

+36
Original file line numberDiff line numberDiff line change
@@ -103,6 +103,34 @@ AC_ARG_ENABLE(
103103
[enable_pedantic="no"]
104104
)
105105

106+
AC_ARG_ENABLE(
107+
[proxy],
108+
[AC_HELP_STRING([--enable-proxy], [enable gnupg-pkcs11-scd-proxy])],
109+
,
110+
[enable_proxy="no"]
111+
)
112+
113+
AC_ARG_WITH(
114+
[proxy-socket],
115+
[AC_HELP_STRING([--with-proxy-socket=FILE], [set proxy socket @<:@LOCALSTATEDIR/run/gnupg-pkcs11-scd-proxy/cmd@:>@])],
116+
,
117+
[with_proxy_socket="\${localstatedir}/run/gnupg-pkcs11-scd-server/cmd"]
118+
)
119+
120+
AC_ARG_WITH(
121+
[proxy-user],
122+
[AC_HELP_STRING([--with-proxy-user=USER], [set proxy user @<:@gnupg-pkcs11-scd-proxy@:>@])],
123+
,
124+
[with_proxy_user="gnupg-pkcs11-scd-proxy"]
125+
)
126+
127+
AC_ARG_WITH(
128+
[proxy-group],
129+
[AC_HELP_STRING([--with-proxy-group=GROUP], [set proxy group @<:@gnupg-pkcs11@:>@])],
130+
,
131+
[with_proxy_group="gnupg-pkcs11"]
132+
)
133+
106134
AC_ARG_WITH(
107135
[openssl],
108136
[AC_HELP_STRING([--without-openssl], [disable OpenSSL linkage)])],
@@ -240,6 +268,12 @@ if test "${with_openssl}" = "no" -a "${with_gnutls}" = "no"; then
240268
AC_MSG_ERROR([Cannot locate OpenSSL or GNUTLS])
241269
fi
242270

271+
AC_SUBST([CONFIG_PROXY_SOCKET], [${with_proxy_socket}])
272+
AC_SUBST([CONFIG_PROXY_USER], [${with_proxy_user}])
273+
AC_SUBST([CONFIG_PROXY_GROUP], [${with_proxy_group}])
274+
AC_DEFINE_UNQUOTED([CONFIG_PROXY_GROUP], ["${with_proxy_group}"], [proxy group])
275+
AM_CONDITIONAL([ENABLE_PROXY], [test "${enable_proxy}" = "yes"])
276+
243277
if test "${with_openssl}" = "yes"; then
244278
AC_MSG_RESULT([Using OpenSSL])
245279
AC_DEFINE([ENABLE_OPENSSL], [1], [Use OpenSSL library])
@@ -290,6 +324,8 @@ AC_DEFINE_UNQUOTED([CONFIG_SYSTEM_CONFIG], ["${SYSTEM_CONFIG}"], [system config]
290324

291325
AC_CONFIG_FILES([
292326
Makefile
327+
gnupg-pkcs11-scd-proxy/Makefile
328+
gnupg-pkcs11-scd-proxy/gnupg-pkcs11-scd-proxy.service.in
293329
gnupg-pkcs11-scd/Makefile
294330
distro/Makefile
295331
distro/debian/Makefile

distro/rpm/gnupg-pkcs11-scd.spec.in

+42-4
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,7 @@ BuildRequires: openssl-devel >= 0.9.7a
1515
BuildRequires: pkcs11-helper-devel >= 1.03
1616
BuildRequires: libassuan-devel
1717
BuildRequires: libgcrypt-devel
18+
BuildRequires: systemd
1819
Requires: openssl >= 0.9.7a
1920
Requires: pkcs11-helper >= 1.03
2021
Requires: libassuan
@@ -25,20 +26,57 @@ gnupg-pkcs11-scd is a drop-in replacement for the smart-card daemon (scd) shippe
2526
next-generation GnuPG (gnupg-2). The daemon interfaces to smart-cards
2627
by using RSA Security Inc. PKCS#11 Cryptographic Token Interface (Cryptoki).
2728

29+
%package proxy
30+
Summary: GnuPG compatible smart-card proxy daemon for gnupg-pkcs11-scd
31+
Requires: %{name} = %{version}-%{release}
32+
Requires(pre): /usr/sbin/useradd
33+
Requires(post): systemd
34+
Requires(preun): systemd
35+
Requires(postun): systemd
36+
37+
%description proxy
38+
A proxy for gnupg-pkcs11-scd.
39+
40+
%pre proxy
41+
getent group gnupg-pkcs11-scd-proxy >/dev/null || groupadd -r gnupg-pkcs11-scd-proxy
42+
getent group gnupg-pkcs11 >/dev/null || groupadd -r gnupg-pkcs11
43+
getent passwd gnupg-pkcs11-scd-proxy >/dev/null || \
44+
useradd -r -g gnupg-pkcs11-scd-proxy -G gnupg-pkcs11 -s /sbin/nologin \
45+
-d / -c "gnupg-pkcs11-scd-proxy" gnupg-pkcs11-scd-proxy
46+
%post proxy
47+
%systemd_post gnupg-pkcs11-scd-proxy.service
48+
%preun proxy
49+
%systemd_preun gnupg-pkcs11-scd-proxy.service
50+
%postun proxy
51+
%systemd_postun gnupg-pkcs11-scd-proxy.service
52+
2853
%prep
2954
%setup -q
3055

3156
%build
32-
%configure
57+
%configure \
58+
--enable-proxy \
59+
--with-proxy-socket=/run/gnupg-pkcs11-scd-proxy/cmd \
60+
%{nil}
3361
%{__make} %{?_smp_mflags}
3462

3563
%install
3664
%{__make} %{?_smp_mflags} install DESTDIR="%{?buildroot}"
65+
install -dm 755 "%{buildroot}%{_unitdir}"
66+
install -m 644 "gnupg-pkcs11-scd-proxy/gnupg-pkcs11-scd-proxy.service" "%{buildroot}%{_unitdir}/"
3767

3868
%files
39-
%{_bindir}/*
40-
%{_mandir}/man1/*
41-
%{_docdir}/%{name}/*
69+
%{_bindir}/gnupg-pkcs11-scd
70+
%{_mandir}/man1/gnupg-pkcs11-scd.*
71+
%{_docdir}/%{name}/COPYING
72+
%{_docdir}/%{name}/README
73+
%{_docdir}/%{name}/gnupg-pkcs11-scd.conf.example
74+
75+
%files proxy
76+
%{_bindir}/gnupg-pkcs11-scd-proxy
77+
%{_bindir}/gnupg-pkcs11-scd-proxy-server
78+
%{_mandir}/man1/gnupg-pkcs11-scd-proxy.*
79+
%{_unitdir}/gnupg-pkcs11-scd-proxy.service
4280

4381
%changelog
4482
* Mon Jan 15 2007 Eddy Nigg <[email protected]>

gnupg-pkcs11-scd-proxy/Makefile.am

+76
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
1+
#
2+
# Copyright (c) 2006-2007 Zeljko Vrba <[email protected]>
3+
# Copyright (c) 2006-2017 Alon Bar-Lev <[email protected]>
4+
# All rights reserved.
5+
#
6+
# Redistribution and use in source and binary forms, with or without
7+
# modification, are permitted provided that the following conditions are met:
8+
#
9+
# o Redistributions of source code must retain the above copyright notice,
10+
# this list of conditions and the following disclaimer.
11+
# o Redistributions in binary form must reproduce the above copyright
12+
# notice, this list of conditions and the following disclaimer in the
13+
# documentation and/or other materials provided with the distribution.
14+
# o Neither the name of the <ORGANIZATION> nor the names of its
15+
# contributors may be used to endorse or promote products derived from
16+
# this software without specific prior written permission.
17+
#
18+
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
19+
# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
20+
# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
21+
# ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
22+
# LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
23+
# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
24+
# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
25+
# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
26+
# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
27+
# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
28+
# POSSIBILITY OF SUCH DAMAGE.
29+
#
30+
31+
MAINTAINERCLEANFILES = \
32+
$(srcdir)/Makefile.in \
33+
$(NULKL)
34+
CLEANFILES = \
35+
gnupg-pkcs11-scd-proxy.1.html \
36+
gnupg-pkcs11-scd-proxy.service \
37+
$(NULL)
38+
39+
SUFFIXES = .in
40+
41+
AM_CPPFLAGS = \
42+
-DCONFIG_PROXY_SOCKET='"@CONFIG_PROXY_SOCKET@"' \
43+
-DCONFIG_SCD_BIN='"$(bindir)/gnupg-pkcs11-scd"' \
44+
$(NULL)
45+
46+
if ENABLE_PROXY
47+
bin_PROGRAMS = \
48+
gnupg-pkcs11-scd-proxy \
49+
gnupg-pkcs11-scd-proxy-server \
50+
$(NULL)
51+
nodist_noinst_DATA = \
52+
gnupg-pkcs11-scd-proxy.service \
53+
$(NULL)
54+
dist_man_MANS = \
55+
gnupg-pkcs11-scd-proxy.1 \
56+
$(NULL)
57+
else
58+
EXTRA_DIST = \
59+
gnupg-pkcs11-scd-proxy.1 \
60+
$(NULL)
61+
endif
62+
63+
gnupg_pkcs11_scd_proxy_SOURCES= \
64+
gnupg-pkcs11-scd-proxy.c \
65+
$(NULL)
66+
67+
gnupg_pkcs11_scd_proxy_server_SOURCES= \
68+
gnupg-pkcs11-scd-proxy-server.c \
69+
$(NULL)
70+
71+
72+
.in:
73+
sed \
74+
-e 's#@bindir_POST[@]#$(bindir)#g' \
75+
-e 's#@CONFIG_PROXY_SOCKET_POST[@]#$(CONFIG_PROXY_SOCKET)#g' \
76+
< $< > $@

0 commit comments

Comments
 (0)