Open pki-bot opened 3 years ago
Comment from cheimes (@tiran) at 2019-01-22 07:47:48
The p11-kit-proxy provider is automatically and globally injected into every NSSDB by /etc/crypto-policies/back-ends/nss.config
. There is currently no way to disable p11-kit-proxy for a NSSDB instance.
$ certutil -d . -f passwd -N
$ cat pkcs11.txt
library=
name=NSS Internal PKCS 11 Module
parameters=configdir='.' certPrefix='' keyPrefix='' secmod='secmod.db' flags= updatedir='' updateCertPrefix='' updateKeyPrefix='' updateid='' updateTokenDescription=''
NSS=Flags=internal,critical trustOrder=75 cipherOrder=100 slotParams=(1={slotFlags=[ECC,RSA,DSA,DH,RC2,RC4,DES,RANDOM,SHA1,MD5,MD2,SSL,TLS,AES,Camellia,SEED,SHA256,SHA512] askpw=any timeout=30})
$ modutil -dbdir . -list
Listing of PKCS 11 Modules
-----------------------------------------------------------
1. NSS Internal PKCS 11 Module
uri: pkcs11:library-manufacturer=Mozilla%20Foundation;library-description=NSS%20Internal%20Crypto%20Services;library-version=3.41
slots: 2 slots attached
status: loaded
slot: NSS Internal Cryptographic Services
token: NSS Generic Crypto Services
uri: pkcs11:token=NSS%20Generic%20Crypto%20Services;manufacturer=Mozilla%20Foundation;serial=0000000000000000;model=NSS%203
slot: NSS User Private Key and Certificate Services
token: NSS Certificate DB
uri: pkcs11:token=NSS%20Certificate%20DB;manufacturer=Mozilla%20Foundation;serial=0000000000000000;model=NSS%203
2. p11-kit-proxy
library name: p11-kit-proxy.so
uri: pkcs11:library-manufacturer=PKCS%2311%20Kit;library-description=PKCS%2311%20Kit%20Proxy%20Module;library-version=1.1
slots: 1 slot attached
status: loaded
slot: Yubico Yubikey NEO OTP+U2F+CCID 00 00
token: PIV_II
uri: pkcs11:token=PIV_II;manufacturer=piv_II;serial=00000000;model=PKCS%2315%20emulated
$ p11-kit list-modules
p11-kit-trust: p11-kit-trust.so
library-description: PKCS11 Kit Trust Module
library-manufacturer: PKCS11 Kit
library-version: 0.23
token: System Trust
manufacturer: PKCS11 Kit
model: p11-kit-trust
serial-number: 1
hardware-version: 0.23
flags:
write-protected
token-initialized
token: Default Trust
manufacturer: PKCS11 Kit
model: p11-kit-trust
serial-number: 1
hardware-version: 0.23
flags:
write-protected
token-initialized
opensc: opensc-pkcs11.so
library-description: OpenSC smartcard framework
library-manufacturer: OpenSC Project
library-version: 0.19
token: PIV_II
manufacturer: piv_II
model: PKCS15 emulated
serial-number: 00000000
flags:
rng
login-required
user-pin-initialized
token-initialized
# p11-kit list-modules
p11-kit-trust: p11-kit-trust.so
library-description: PKCS11 Kit Trust Module
library-manufacturer: PKCS11 Kit
library-version: 0.23
token: System Trust
manufacturer: PKCS11 Kit
model: p11-kit-trust
serial-number: 1
hardware-version: 0.23
flags:
token-initialized
token: Default Trust
manufacturer: PKCS11 Kit
model: p11-kit-trust
serial-number: 1
hardware-version: 0.23
flags:
write-protected
token-initialized
opensc: opensc-pkcs11.so
library-description: OpenSC smartcard framework
library-manufacturer: OpenSC Project
library-version: 0.19
token: PIV_II
manufacturer: piv_II
model: PKCS15 emulated
serial-number: 00000000
flags:
rng
login-required
user-pin-initialized
token-initialized
softhsm2: /usr/lib64/pkcs11/libsofthsm2.so
library-description: Implementation of PKCS11
library-manufacturer: SoftHSM
library-version: 2.5
token: pkitoken
manufacturer: SoftHSM project
model: SoftHSM v2
serial-number: 0f7c15eb65ad6510
hardware-version: 2.5
firmware-version: 2.5
flags:
rng
login-required
user-pin-initialized
restore-key-not-needed
token-initialized
token:
manufacturer: SoftHSM project
model: SoftHSM v2
serial-number:
hardware-version: 2.5
firmware-version: 2.5
flags:
rng
login-required
restore-key-not-needed
so-pin-locked
so-pin-to-be-changed
Comment from cheimes (@tiran) at 2019-01-22 07:47:49
Metadata Update from @tiran:
Comment from cheimes (@tiran) at 2019-01-22 07:51:26
I think that p11-kit proxy only proxies configured PKCS11 provides:
$ ls /usr/share/p11-kit/modules/
opensc.module p11-kit-trust.module softhsm2.module
Comment from abbra (@abbra) at 2019-04-25 03:03:26
For now, we are pushing https://github.com/freeipa/freeipa/pull/3063 to FreeIPA to globally disable p11-kit proxying of SoftHSM module on IPA masters.
Please take a look at how this patch breaks dnssec, detailed here: https://pagure.io/freeipa/issue/8757
This issue was migrated from Pagure Issue #3091. Originally filed by cheimes (@tiran) on 2019-01-22 07:14:24:
Fedora 29 has enabled p11-kit-proxy module globally, https://fedoraproject.org/wiki/Changes/NSSLoadP11KitModules . The p11-kit-proxy module loads and provides other PKCS11 libraries such as softhsm2. Since a PKCS11 provider should not be enabled twice, modutil refuses to add a module to Dogtag's NSSDB without additional confirmation. For example Dogtag installation with pki_hsm_enable and SoftHSM2 fails with error message:
For Fedora 29 and probably also RHEL 8, Dogtag should no longer add PKCS11 modules to its own NSSDB. Instead it should rely on system wide registration and configuration of PKCS11 modules by p11-kit.