jmpolom

How to configure Flatpak apps for PKCS#11 and smart cards

Flatpak allows users to manually configure filesystem paths that will get passed into the Flatpak application sandbox via flatpak override. This feature can also pass in a unix socket, which works to pass in a dynamically started p11-kit-server socket from the host to access PKCS#11 devices. This will let you access web sites requiring smart card certificate authentication from a web browser installed via Flatpak.

Pre-requisites

• Flatpak installed and working
• Web browser that supports p11-kit installed via Flatpak (ex: Microsoft Edge or Chromium from flathub)
• systemd, pcscd, opensc, and p11-kit packages installed on the host

Procedure

jmpolom

# everything
*

# exceptions
!.gitignore
!.config/
!.config/systemd/
!.config/systemd/user/
!.config/systemd/user/**

jmpolom

# text install
text --non-interactive

# fedora repos
url --metalink="https://mirrors.fedoraproject.org/metalink?repo=fedora-$releasever&arch=$basearch"
repo --name=fedora --metalink="https://mirrors.fedoraproject.org/metalink?repo=fedora-$releasever&arch=$basearch"
repo --name=updates --metalink="https://mirrors.fedoraproject.org/metalink?repo=updates-released-f$releasever&arch=$basearch"

# rpmfusion repos
repo --name=rpmfusion-free --metalink="https://mirrors.rpmfusion.org/metalink?repo=free-fedora-35&arch=x86_64" --includepkgs=rpmfusion-free-release

jmpolom

- name: search test
  hosts: localhost
  connection: local
  gather_facts: no
  vars:
    kargs: "resume=/dev/mapper/fedora-swap rd.lvm.lv=fedora/root rd.luks.uuid=luks-6937d598-6a2f-4019-bb29-924f5c34467a rd.lvm.lv=fedora/swap rhgb quiet console=tty1 console=ttyS0,115200n8 ip=dhcp"
    karg_ip: "ip=dhcp" 
    additional_kargs: []
  tasks:
    - name: compile kargs to add

jmpolom

#!/bin/bash

#KERNEL_VERSION=$(uname -r)
KERNEL_VERSION="5.13.3-200.fc34.x86_64"

KERNEL_RPM_VERSION=${KERNEL_VERSION%-*}
echo $KERNEL_RPM_VERSION

KERNEL_RPM_RELEASE=${KERNEL_VERSION%.*}
echo $KERNEL_RPM_RELEASE

jmpolom

search generally for an ip= kernel argument. if one does not exist, add it.

r = re.compile(r'(?P<grub_cmdline>^GRUB_CMDLINE_LINUX=(?!.*?ip=)\"[^\"]*?\"$)')

search for an exact match; if none found isolate an existing ip= kernel argument for removal.

r = re.compile(r'^(?PGRUB_CMDLINE_LINUX=(?!.*?ip=192.168.1.21::192.168.1.254:255.255.255.0:::)\"[^\"]*?)\s?(?:ip=\S+)\s?(?P[^\"]+\")$')

jmpolom

- name: test regex with lineinfile to edit default grub config
  hosts: localhost
  connection: local
  gather_facts: no
  vars:
    ip_string: "ip=192.168.1.211::192.168.1.254:255.255.255.0:::"
  tasks:
    - name: edit GRUB_CMDLINE_LINUX
      ansible.builtin.lineinfile:
        backrefs: yes

jmpolom

Detroit Style Pizza

Dough

• 1.75 cups water at 85℉
• 0.5 cup semolina flour
• 2 tsp sugar
• 2 tsp instant dry yeast
• 3.5 cups bread or bakers flour