Bug#1077676: pcscd: unprivileged users not authorized to access OpenPGP smart cards

[Gian Piero Carrubba]

* [Thu, Aug 01, 2024 at 07:33:46AM GMT] Mark Hindley:
>On Thu, Aug 01, 2024 at 01:04:11AM +0200, Gian Piero Carrubba wrote:
>> The problem seems to be that update-rc.d orders the init scripts so that xdm
>> starts before elogind, so waiting for elogind to start before logging in
>> solves the issue.
>>
>> Is this something the elogind package can solve? My guess is that's xdm's
>> (and other dm) duty...
>
>I don't think there is a bug in elogind here, or anything elogind can do about
>it.
>
>AFAIK xdm doesn't use logind (systemd or elogind).

The problem is registering an xdm-initiated session with elogind.  
/etc/pam.d/xdm includes /etc/pam.d/common-session that calls 
libpam-elogind, so in this sense xdm uses elogind.

>So if you want to enforce
>this ordering xdm, try adding
>
> # X-Start-Before: elogind
>
>in /etc/init.d/xdm.

It's the other way around: it's /etc/init.d/elogind that should include

  # X-Start-Before: xdm

but obviously that would only work for xdm and not for other display 
managers. But I've just discovered that xdm ships 
/etc/insserv.conf.d/xdm that reads:

$x-display-manager              xdm

So, if the $x-display-manager is standardized by the Debian Policy 
(i.e., all the display managers define the facility) and if it would not 
cause problems on systems that don't have a display manager installed (I 
haven't tested), the solution should be for elogind to include

  # X-Start-Before: $x-display-manager

in its own init script.

Thanks,
Gian Piero.