Re: [Spice-devel] usbredir and rights management

2012-02-08 Thread Frédéric Grelot
> The suid helper is a short-lived process, which gets invoked > after a new device has been plugged in, so it cannot differentiate > between newly plugged in and already present devices. Besides that > plugging in devices requires physical access, what is to stop a user > from unplugging and re-p

Re: [Spice-devel] usbredir and rights management

2012-02-08 Thread Hans de Goede
Hi, On 02/08/2012 03:55 PM, Frédéric Grelot wrote: As mentioned in my original mail, the helper uses PolicyKit to ask for permission to redirect the device, it is PolicyKit which asks for the root password, not the helper. In the blog post I linked to are instructions to change the policy so

Re: [Spice-devel] usbredir and rights management

2012-02-08 Thread Frédéric Grelot
> > As mentioned in my original mail, the helper uses PolicyKit to ask > for > permission to redirect the device, it is PolicyKit which asks for the > root password, not the helper. In the blog post I linked to are > instructions to change the policy so that local (so behind the > keyboard of the

Re: [Spice-devel] usbredir and rights management

2012-02-08 Thread Hans de Goede
Hi, On 02/08/2012 01:25 PM, Frédéric Grelot wrote: Hi Hans, Would it be possible to restrict this root helper to make it executable by any users of a specific group without forcing them to give the root password? I would think of something like helper (suid root) -> check user group -> opens

Re: [Spice-devel] usbredir and rights management

2012-02-08 Thread Frédéric Grelot
Hi Hans, Would it be possible to restrict this root helper to make it executable by any users of a specific group without forcing them to give the root password? I would think of something like helper (suid root) -> check user group -> opens up the device give and filter command to ensure that t

Re: [Spice-devel] usbredir and rights management

2012-02-08 Thread Hans de Goede
Hi, On 02/07/2012 09:40 PM, Dominique Rodrigues wrote: Hi, I have compiled spice-gtk (version 0.9) to support usbredir (version 3.3 compiled and installed) on 2 type of OS : Mageia and Debian (wheezy). I appears that usb redirection involves root in different ways for these OS. For mageaia,

Re: [Spice-devel] usbredir and rights management

2012-02-07 Thread Dominique Rodrigues
Le 08/02/2012 00:17, Gianluca Cecchi a écrit : On Tue, Feb 7, 2012 at 11:45 PM, Dominique Rodrigues wrote: Here is for instance a message from a Debian (wheezy) Desktop when I plug a USB key with spice-gtk : Could not auto-redirect USB Mass Storage USB Mass Storage [0ef5:2366]

Re: [Spice-devel] usbredir and rights management

2012-02-07 Thread Gianluca Cecchi
On Tue, Feb 7, 2012 at 11:45 PM, Dominique Rodrigues wrote: > > Here is for instance a message from a Debian (wheezy) Desktop when I plug > a USB key with spice-gtk : > > Could not auto-redirect USB Mass Storage USB Mass Storage [0ef5:2366] at > 3-2: Could not open usb device: Access denied (ins

Re: [Spice-devel] usbredir and rights management

2012-02-07 Thread Dominique Rodrigues
On Tue, 07 Feb 2012 21:40:26 +0100, Dominique Rodrigues wrote: Hi, I have compiled spice-gtk (version 0.9) to support usbredir (version 3.3 compiled and installed) on 2 type of OS : Mageia and Debian (wheezy). I appears that usb redirection involves root in different ways for these OS. For