<html> <head> <meta content="text/html; charset=UTF-8" http-equiv="Content-Type"> </head> <body bgcolor="#FFFFFF" text="#000000"> <div class="moz-cite-prefix">On 12/23/2014 12:49 PM, Jeremy White wrote: </div> <blockquote cite="mid:5499D572.70602@codeweavers.com" type="cite"> I am hoping to ask: 1. Does this basic approach seem reasonable? </blockquote> It depends on usage. The main thing to be careful of is card sharing between various VMs and hosts. They fall into two categories: card locking - software like pcsc-lite allows applications to lock the card. APDUs are stateful, and if you have two entities* sending APDUs to the card at the same time you can run into various issues (like one entity switching applets out from under another entity, or the failure to complete on global platform secure channel (which requires full protocol of APDUs and responses orchestrated together without any intervening APDUs). card login state - Cards are logged in or not logged in globally. This means that if the host or one VM is logged into a card, all of them are. As long as you are only accessing the card from one VM at a time then you are fine. <blockquote cite="mid:5499D572.70602@codeweavers.com" type="cite"> 2. Anyone know what the origin of the VCARD_DIRECT code path was? I use it here. git-blame pins it back to the original libcacard commit; not sure where it came from before then. I was trying to find an alternate consumer of that code to make sure I was aligned with it. </blockquote> I think initially we emulated the card the client side of spice rather than in the VM. Upstream preferred it happening in the VM, and that a generic protocol smart card protocol should be used. If you are just using APDU's as your protocol from the VM to the host, but are still emulating at the host, then you don't have any of the issues in 1 above. <blockquote cite="mid:5499D572.70602@codeweavers.com" type="cite"> I believe that, with this change, a system that was not otherwise using a smart card could relay that smart card on to a distant Spice server. I'm uncertain what would happen in the case where the smart card was in use by the local system. That's something I'll need to probe yet. I imagine that it won't work, but have no real hard evidence for that :-/. </blockquote> If you aren't emulating, things will seem to work most of the time and fail randomly (when applications decide to colide)... and attackers in the VM could get access to a logged in smart card without supplying a ping. If you are emulating on the spice side, however, sending raw apdu's are just fine. bob <blockquote cite="mid:5499D572.70602@codeweavers.com" type="cite"> Cheers, Jeremy <fieldset class="mimeAttachmentHeader"></fieldset> <pre wrap="">_______________________________________________ Spice-devel mailing list <a class="moz-txt-link-abbreviated" href="mailto:Spice-devel@lists.freedesktop.org">Spice-devel@lists.freedesktop.org</a> <a class="moz-txt-link-freetext" href="http://lists.freedesktop.org/mailman/listinfo/spice-devel">http://lists.freedesktop.org/mailman/listinfo/spice-devel</a> </pre> </blockquote> </body> </html>