Bug 194548

Description of problem:

gnupg ccid driver requires both read and write pemissons to the USB device node
of the attached smart card reader (ex. the widely used SCR-335). Default
installation doesn't create a scard group which is required for setting the
access permissions on a per-group basis (users belonging to the scard group will
be able to write to smart card reader devices), as well as missing udev/proper
permission setting rules/script.

Version-Release number of selected component (if applicable):

gpg (GnuPG) 1.4.3

How reproducible:

Always.

Steps to Reproduce:
1. Plug a USB smart card reader.
2. Issue the 'gpg --card-status' command as normal user
3. Issue the 'gpg --card-status' command as root user
  
Actual results:

Non-root users are unable to use smart cards with the gnupg ccid driver.
scard group doesn't exist.
Permissions for device noes aren't set and udev rules are missing.

Expected results:

Non privileged users in the scard group should be able to make use of smart
cards equipment without need of transition to a privileged account.

Additional info:

SELinux has nothing to do with this bug, but it could be used to apply
fine-grained permissions for controlling access to smart card devices, instead
of the standard Linux kernel DAC (user/group based permissions).

Example fix:

(Used lsusb from usbutils package for determining the bus and device node used
by the reader, thanks to Steve Grubb for pointing this out)

[lorenzo@echidna]$ gpg --card-status
gpg: pcsc_establish_context failed: no service (0x8010001d)
gpg: card reader not available
[lorenzo@echidna]$ sudo chown -R root.scard /dev/bus/usb/002/
[lorenzo@echidna]$ sudo chmod g+w -R /dev/bus/usb/002/
[lorenzo@echidna]$ gpg --card-status
Application ID ...: (...)
Version ..........: 1.1
Manufacturer .....: (...)
Serial number ....: (...)

I've found that some other users had trouble with this as well:
http://www.gossamer-threads.com/lists/gnupg/users/36991