Howto set Console ACLs with PolicyKit and HAL for a Palm device

As pointed out in https://bugzilla.redhat.com/show_bug.cgi?id=158809#c34 , the problem syncing with a palm device are the changing devices, once you press the hotsync button. Using the USB support in pilot-xfer with

$ pilot-xfer -p usb: -l

instead of the command with a kludgy /dev/pilot symlink

$ pilot-xfer -p /dev/pilot -l

fails because the USB device does not have the right permissions. With the introduction of PolicyKit and ACLs for console users in Fedora 8, we can now solve the problem in the right way.

First we create a policy type pda by creating the file /usr/share/hal/fdi/policy/10osvendor/19-palm-acl-management.fdi

# cat > /usr/share/hal/fdi/policy/10osvendor/19-palm-acl-management.fdi <<EOF
<?xml version="1.0" encoding="UTF-8"?>

<deviceinfo version="0.2">
  <device>
    <match key="info.capabilities" contains="pda">
      <match key="pda.platform" string="palm">
        <append key="info.capabilities" type="strlist">access_control</append>
        <merge key="access_control.type" type="string">pda</merge>
        <merge key="access_control.file" type="copy_property">pda.palm.hotsync_interface</merge>
      </match>
    </match>
  </device>
</deviceinfo>
EOF

Now, we have to assign this policy to the device nodes of a device. This can be done by creating policies which look like:

   <match key="usb_device.vendor_id" int="0x082d">
      <match key="usb_device.product_id" int="0x0100">
          <append key="info.capabilities" type="strlist">pda</append>
          <merge key="pda.platform" type="string">palm</merge>
          <merge key="pda.palm.hotsync_interface" type="copy_property">linux.device_file</merge>
      </match>
   </match>

An example of /usr/share/hal/fdi/policy/10osvendor/20-pda-acl-management.fdi can be installed by:

# wget -O /usr/share/hal/fdi/information/20thirdparty/10-usb-pda-palm.fdi  'https://bugzilla.redhat.com/attachment.cgi?id=294520'

Finally we prevent the "visor" module to be automatically loaded by creating the file /etc/modprobe.d/blacklist-visor, because the visor module would take over the USB device and make it a serial ttyUSB.

# echo 'blacklist visor' > /etc/modprobe.d/blacklist-visor

Now you want to restart HAL and remove the visor module:

# service haldaemon restart
# rmmod visor

With all these files in place, we can now do the

$ pilot-xfer -p usb: -l

as a normal user. That's it. No hacky udev rule involved. This example can be applied to any other device which should be accessible by a console user.

The way I read man PolicyKit.conf, it is even possible to grant access to specific groups and users permanently.

Happy Syncing!

Update: Active development also in https://bugzilla.redhat.com/show_bug.cgi?id=280251#c120

Not working? Read the checklist.