Closed flipsa closed 5 years ago
Your problem seems to be:
Jun 24 15:21:27 tp pcscd[6107]: /var/tmp/portage/sys-apps/pcsc-lite-1.8.25/work/pcsc-lite-1.8.25/src/auth.c:135:IsClientAuthorized() Process 1837 (user: 1001) is NOT authorized for action: access_card
See https://github.com/LudovicRousseau/PCSC/blob/master/doc/README.polkit
Thanks for the quick answer!
I saw that line in the logs, too, but I didn't think that this was my problem, since everything does work absolutely fine if I either restart or stop the pcscd service and hence ruled out any permission problems.
But to be absolutely sure I just added the polkit rules and got rid of the "not authorized" error above, but the original problem still persists.
gpg --card-status
works fine if pcscd is NOT running?
gpg --card-status
works fine if pcscd is NOT running?
Yes, if I stop pcscd and then run gpg --card-status
, it works. Alternatively I can also restart pcscd and it also works. But as soon as I pull the Yubikey and then re-insert it, gpg --card-status
will fail. I noticed pcscd gets started automatically when I insert the Yubikey, but somehow it does not manage to put the Yubikey in a working state. However, both stopping or restarting pcscd will make the Yubikey accessible and working fine. I know it's weird, but it is what I'm seeing here.
One thought I had: do you think it's possible that gpg (or pcscd) somehow get "confused" by the built-in smart card reader while the Yubikey is still in limbo / initializing?
I wrote an new article about this FAQ. See https://ludovicrousseau.blogspot.com/2019/06/gnupg-and-pcsc-conflicts.html
Does the proposed solution work for you?
Hello Ludovic,
Thanks for writing that FAQ, it all makes perfect sense now.
The 2nd solution works for me (disable-ccid
in ~/.gnupg/scdaemon.conf
).
Getting rid of pcscd altogher wasn't possible for me, since I need it for other things as well.
Closing this as solved. Thank you very much!
Hey there,
I got a problem in regards to using a Yubikey 5 NFC for GPG on my Linux system. When I insert the Yubikey:
I can make it work then by either: i) making sure that pcscd is NOT running (the service starts by itself when inserting the Yubikey even if it was stopped before), or ii) by restarting pcscd. Afterwards the Yubikey is detected without issues, and I can use it as intended.
I searched the issues here (and the web), and my issue is not like #57 as the Yubikey device number changes on removal and re-plugging the Yubikey.
My setup is:
lsusb output (the device number increments fine on removal/reinsertion):
pcscd debug log (:
When inserting the Yubikey (debug log from above continued)
Now trying "gpg --card-status --expert" in another terminal (debug log from above continued):
The same experiment, as logged by syslog: pcscd is running, then I insert the Yubikey, then I restart pcscd; after this, the key works fine without any other action (I don't know how to do this with the debug output on as above):
Trying gpg --card-status --expert (in another terminal):
Restarting pcscd:
gpg --card-status --expert (in another terminal):
Let me know if you need more information.
And of course thank your very much for your software and help, it's much appreciated!