Rejected unauthorized PC/SC client // PC/SC doesn't let me access my yubikey

[svpi11]

- YubiKey Manager (ykman) version:

YubiKey Manager (ykman) version: 5.5.1

- How was it installed?:

Both on apt (ykman, scdaemon, pcscd, and all packages adviced to), and then when the problem appeared, tried also via pip install (as recommended in the doc). Same problem

- Operating system and version:

Everything was working fine for years. Updated yesterday my server from Ubuntu Server 22.04 LTS to 24.04 LTS, cannot access the Yubikey anymore.

- YubiKey model and version:

Device type: YubiKey 5 Nano
Serial number: myserial
Firmware version: 5.4.3
Form factor: Nano (USB-A)
Enabled USB interfaces: OTP, FIDO, CCID

- Bug description summary:

Since the upgrade, PCSC daemon apparently doesn't authorize me to access the yubikey anymore.

Steps to reproduce

Upgrade to 24.04, applied less changes as possible during the upgrade (N option). Now the same yubikey and server and cannot connect anymore.

Expected result
Connect to my yubikey data throw 24.04 LTS

Actual results and logs

Here is the result of ykman info :

WARNING: PC/SC not available. Smart card (CCID) protocols will not function.
ERROR: Unable to list devices for connection
Device type: YubiKey 5 Nano
Serial number: myserial
Firmware version: 5.4.3
Form factor: Nano (USB-A)
Enabled USB interfaces: OTP, FIDO, CCID

Applications
Yubico OTP Enabled
FIDO U2F Enabled
FIDO2 Enabled
OATH Enabled
PIV Enabled
OpenPGP Enabled
YubiHSM Auth Enabled

Here of gpg --card-status :
ubuntu@serveur:~$ gpg --card-status
gpg: selecting card failed: Aucun périphérique de ce type
gpg: la carte OpenPGP n'est pas disponible : Aucun périphérique de ce type

So apparently the problem comes from PC/SC and permissions. I tried to add rules specifications as in the doc ( exact 2 sames files). Updates rules, still same result.
Here are the logs of PC/SC daemon:

ubuntu@serveur:~$ sudo systemctl status pcscd
● pcscd.service - PC/SC Smart Card Daemon
Loaded: loaded (/usr/lib/systemd/system/pcscd.service; indirect; preset: enabled)
Active: active (running) since Wed 2024-07-24 20:03:40 CEST; 1min 37s ago
TriggeredBy: ● pcscd.socket
Docs: man:pcscd(8)
Main PID: 6595 (pcscd)
Tasks: 8 (limit: 9385)
Memory: 1.7M (peak: 2.6M)
CPU: 85ms
CGroup: /system.slice/pcscd.service
└─6595 /usr/sbin/pcscd --foreground --auto-exit

juil. 24 20:03:41 serveur pcscd[6595]: 00131311 auth.c:143:IsClientAuthorized() Process 6451 (user: 1000) is NOT authorized for action: access_pcsc
juil. 24 20:03:41 serveur pcscd[6595]: 00000121 winscard_svc.c:355:ContextThread() Rejected unauthorized PC/SC client
juil. 24 20:04:39 serveur pcscd[6595]: 58269185 auth.c:143:IsClientAuthorized() Process 7809 (user: 1000) is NOT authorized for action: access_pcsc
juil. 24 20:04:39 serveur pcscd[6595]: 00000140 winscard_svc.c:355:ContextThread() Rejected unauthorized PC/SC client
juil. 24 20:04:39 serveur pcscd[6595]: 00116773 auth.c:143:IsClientAuthorized() Process 7809 (user: 1000) is NOT authorized for action: access_pcsc
juil. 24 20:04:39 serveur pcscd[6595]: 00000178 winscard_svc.c:355:ContextThread() Rejected unauthorized PC/SC client

• ubuntu is member of the plugdev group.

[svpi11]

Little update: I just did a little apt update/upgrade this morning (some linux-headers) and at my surprise it works fine now since then... Didn't change anything more ahah... I close the issue, but don't know exactly yet what was the problem there...

[derekchoate]

Seems access is controlled via polkit now...

https://www.freedesktop.org/software/polkit/docs/latest/polkit.8.html

https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/8/html/security_hardening/assembly_controlling-access-to-smart-cards-using-polkit_security-hardening#assembly_controlling-access-to-smart-cards-using-polkit_security-hardening

So, I created a group called "ykusers" and assigned appropriate users, then finally created a rule to grant access to users in that group

/usr/share/polkit-1/rules.d/ykman-users.rules
polkit.addRule(function(action, subject) { if (subject.isInGroup("ykusers")) { return polkit.Result.YES; } })