Latest revision as of 06:56, 29 August 2019

NSS load p11-kit modules by default

Summary

When NSS database is created, PKCS#11 modules configured in the system's p11-kit will be automatically registered and visible to NSS applications.

Owner

Name: Daiki Ueno
Email: dueno@redhat.com
Release notes owner:

Current status

Targeted release: Fedora 29
Last updated: 2019-08-29
Tracker bug: #1592206
Release Notes tracking: #184

Detailed Description

Fedora provides a mechanism to configure PKCS#11 modules system wide, allowing the crypto libraries (GnuTLS and OpenSSL) to use PKCS#11 modules in a consistent manner. Until now NSS applications haven't benefit from it as NSS uses a different configuration mechanism which requires users to register PKCS#11 modules in NSS databases. This change makes the manual procedure unnecessary, by registering the p11-kit-proxy module (the aggregator of the system PKCS#11 modules) in NSS databases with the default configuration.

Benefit to Fedora

This change allows NSS applications to use PKCS#11 modules in the same way as other crypto libraries, bringing consistency in PKCS#11 driver registration across the OS. That improves user experience of smartcards and HSMs on Fedora.

Scope

Proposal owners:
- Enable p11-kit-proxy in the newly created NSS database, through the crypto-policies package.
- Modify the opensc package not to register itself to the NSS database upon installation.

Other developers:
- Make sure that this change doesn't cause any regression with the existing applications.

Release engineering: #7548
- List of deliverables: N/A

Policies and guidelines: PackageMaintainers/PKCS11 needs changes basically to eliminate NSS specific stuff

Trademark approval: N/A (not needed for this Change)

Upgrade/compatibility impact

Uncommon/undocumented scenarios may be affected, in particular if the user previously used a configuration which conflicts with this change. In addition to that, support for the third party / proprietary PKCS#11 modules is out of scope of this proposal. That is, if the user had previously installed a p11-kit configuration file for such modules, it could stop working. Even then, she can remove the configuration file and manually register the module through the application (e.g., Firefox's preferences).

bugzilla.redhat.com - 2019-08-27 p11-kit-trust breaks pkcs11 client-certificate authentication with Firefox

How To Test

Install a PKCS#11 module, say softhsm or opensc. These modules should be ready to use after installing the packages with DNF. To use them as HSM you need to initialize a token with softhsm2-util or attach a hardware device supported by OpenSC, such as Nitrokey (see the wiki for details).
Start Firefox and check if the module is listed in Preferences -> Privacy & Security -> Security Devices...
Create an NSS database: certutil -d sql:nssdb -N --empty-password
List modules registered to the NSS database: modutil -dbdir sql:nssdb -list
Check that the output includes the PKCS#11 module installed on the step 1:

   Listing of PKCS #11 Modules
   -----------------------------------------------------------
     1. NSS Internal PKCS #11 Module
   	   uri: pkcs11:library-manufacturer=Mozilla%20Foundation;library-description=NSS%20Internal%20Crypto%20Services;library-version=3.36
   	 slots: 2 slots attached
   	status: loaded
   
   [...]
   
     2. p11-kit-proxy
   	library name: p11-kit-proxy.so
   	   uri: pkcs11:library-manufacturer=PKCS%2311%20Kit;library-description=PKCS%2311%20Kit%20Proxy%20Module;library-version=1.1
   	 slots: 5 slots attached
   	status: loaded
   [...]
   	 slot: SoftHSM slot ID 0x0
   	token: 
   	  uri: pkcs11:manufacturer=SoftHSM%20project;model=SoftHSM%20v2
   -----------------------------------------------------------

User Experience

The users of NSS applications (e.g. firefox and sssd) would be able to use supported smartcards and HSMs without further configuration.

Dependencies

firefox, and possibly sssd's smartcard support

Contingency Plan

Contingency mechanism: Revert the change in nss, p11-kit, or crypto-policies
Contingency deadline: Beta freeze
Blocks release? No
Blocks product? No

Documentation

No new documentation needed, but the existing documentation should be modified to remove the special cases of NSS.

Release Notes

It should be sufficient to have a simple sentence mentioning this change and how to opt-out from it.

Release Notes tracking: #184

@@ Line 1: / Line 1: @@
-<!-- Self Contained or System Wide Change Proposal?
+= NSS load p11-kit modules by default =
-Use this guide to determine to which category your proposed change belongs to.
-Self Contained Changes are:
-* changes to isolated/leaf package without the impact on other packages/rest of the distribution
-* limited scope changes without the impact on other packages/rest of the distribution
-* coordinated effort within SIG with limited impact outside SIG functional area, accepted by the SIG
-System Wide Changes are:
-* changes that does not fit Self Contained Changes category touching
-* changes that require coordination within the distribution (for example mass rebuilds, release engineering or other teams effort etc.)
-* changing system defaults
-For Self Contained Changes, sections marked as "REQUIRED FOR SYSTEM WIDE CHANGES" are OPTIONAL but FESCo/Wrangler can request more details (especially in case the change proposal category is
-improper or updated to System Wide category). For System Wide Changes all fields on this form are required for FESCo acceptance (when applies).
-We request that you maintain the same order of sections so that all of the change proposal pages are uniform.
--->
-<!-- The actual name of your proposed change page should look something like: Changes/Your_Change_Proposal_Name.  This keeps all change proposals in the same namespace -->
-<!-- The actual name of your proposed change page should look something like: Changes/Your_Change_Proposal_Name.  This keeps all change proposals in the same namespace -->
-= NSS load p11-kit modules by default <!-- The name of your change proposal --> =
 == Summary ==
-<!-- A sentence or two summarizing what this change is and what it will do. This information is used for the overall changeset summary page for each release.
+When NSS database is created, PKCS#11 modules configured in the system's p11-kit will be automatically registered and visible to NSS applications.
-Note that motivation for the change should be in the Motivation section below, and this part should answer the question "What?" rather than "Why?". -->
-When NSS database is created, the PKCS#11 modules configured in the system's p11-kit will be automatically registered and visible to applications.
 == Owner ==
-<!--
-For change proposals to qualify as self-contained, owners of all affected packages need to be included here. Alternatively, a SIG can be listed as an owner if it owns all affected packages.
-This should link to your home wiki page so we know who you are.
--->
 * Name: [[User:Ueno| Daiki Ueno]]
-<!-- Include you email address that you can be reached should people want to contact you about helping with your change, status is requested, or technical issues need to be resolved. If the change proposal is owned by a SIG, please also add a primary contact person. -->
 * Email: dueno@redhat.com
 * Release notes owner: <!--- To be assigned by docs team [[User:FASAccountName| Release notes owner name]] <email address> -->
@@ Line 56: / Line 27: @@
 CLOSED as NEXTRELEASE -> change is completed and verified and will be delivered in next release under development
 -->
-* Tracker bug: <will be assigned by the Wrangler>
+* Tracker bug: [https://bugzilla.redhat.com/show_bug.cgi?id=1592206 #1592206]
+* Release Notes tracking: [https://pagure.io/fedora-docs/release-notes/issue/184 #184]
 == Detailed Description ==
-<!-- Expand on the summary, if appropriate.  A couple sentences suffices to explain the goal, but the more details you can provide the better. -->
+Fedora provides a mechanism to configure PKCS#11 modules system wide, allowing the crypto libraries (GnuTLS and OpenSSL) to use PKCS#11 modules in a consistent manner. Until now NSS applications haven't benefit from it as NSS uses a different configuration mechanism which requires users to register PKCS#11 modules in NSS databases. This change makes the manual procedure unnecessary, by registering the p11-kit-proxy module (the aggregator of the system PKCS#11 modules) in NSS databases with the default configuration.
-While Fedora provides a way of configuring PKCS#11 modules on the system through p11-kit, NSS applications by default didn't benefit from it and the users had to register necessary modules with modutil manually.  Making NSS also aware of the system configuration will bring them a consistent user experience regarding PKCS#11 and smartcards.
 See also:
@@ Line 68: / Line 39: @@
 == Benefit to Fedora ==
-<!-- What is the benefit to the distribution?  Will the software we generate be improved? How will the process of creating Fedora releases be improved?
+This change allows NSS applications to use PKCS#11 modules in the same way as other crypto libraries, bringing consistency in PKCS#11 driver registration across the OS.  That improves user experience of smartcards and HSMs on Fedora.
-      Be sure to include the following areas if relevant:
-      If this is a major capability update, what has changed?
-           For example: This change introduces Python 5 that runs without the Global Interpreter Lock and is fully multithreaded.
-      If this is a new functionality, what capabilities does it bring?
-           For example: This change allows package upgrades to be performed automatically and rolled-back at will.
-      Does this improve some specific package or set of packages?
-           For example: This change modifies a package to use a different language stack that reduces install size by removing dependencies.
-      Does this improve specific Spins or Editions?
-           For example: This change modifies the default install of Fedora Workstation to be more in line with the base install of Fedora Server.
-      Does this make the distribution more efficient?
-           For example: This change replaces thousands of individual %post scriptlets in packages with one script that runs at the end.
-      Is this an improvement to maintainer processes?
-           For example: Gating Fedora packages on automatic QA tests will make rawhide more stable and allow changes to be implemented more smoothly.
-      Is this an improvement targeted as specific contributors?
-           For example: Ensuring that a minimal set of tools required for contribution to Fedora are installed by default eases the onboarding of new contributors.
-     When a Change has multiple benefits, it's better to list them all.
-     Consider these Change pages from previous editions as inspiration:
-     https://fedoraproject.org/wiki/Changes/Annobin (low-level and technical, invisible to users)
-     https://fedoraproject.org/wiki/Changes/ParallelInstallableDebuginfo (low-level, but visible to advanced users)
-     https://fedoraproject.org/wiki/Changes/VirtualBox_Guest_Integration (primarily a UX change)
-     https://fedoraproject.org/wiki/Changes/NoMoreAlpha (an improvement to distro processes)
-     https://fedoraproject.org/wiki/Changes/perl5.26 (major upgrade to a popular software stack, visible to users of that stack)
--->
-NSS applications can use PKCS#11 modules without special configuration procedure to NSS.
 == Scope ==
 * Proposal owners:
-<!-- What work do the feature owners have to accomplish to complete the feature in time for release?  Is it a large change affecting many parts of the distribution or is it a very isolated change? What are those changes?-->
+** Enable p11-kit-proxy in the newly created NSS database, through the crypto-policies package.
-- Modify the crypto-policies package to enable p11-kit-proxy in the newly created NSS database.
+** Modify the opensc package not to register itself to the NSS database upon installation.
-- Make sure that this change doesn't cause any regression with the existing applications.
-* Other developers: N/A (not a System Wide Change) <!-- REQUIRED FOR SYSTEM WIDE CHANGES -->
+* Other developers:
-<!-- What work do other developers have to accomplish to complete the feature in time for release?  Is it a large change affecting many parts of the distribution or is it a very isolated change? What are those changes?-->
+** Make sure that this change doesn't cause any regression with the existing applications.
-* Release engineering: [https://pagure.io/releng/issues #Releng issue number] (a check of an impact with Release Engineering is needed) <!-- REQUIRED FOR SYSTEM WIDE AS WELL AS FOR SELF CONTAINED CHANGES -->
+* Release engineering: [https://pagure.io/releng/issue/7548 #7548] <!-- REQUIRED FOR SYSTEM WIDE AS WELL AS FOR SELF CONTAINED CHANGES -->
 <!-- Does this feature require coordination with release engineering (e.g. changes to installer image generation or update package delivery)?  Is a mass rebuild required?  include a link to the releng issue.
 The issue is required to be filed prior to feature submission, to ensure that someone is on board to do any process development work and testing, and that all changes make it into the pipeline; a bullet point in a change is not sufficient communication -->
@@ Line 112: / Line 55: @@
 <!-- Please check the list of Fedora release deliverables and list all the differences the feature brings -->
-* Policies and guidelines: [[PackageMaintainers/PKCS11]] <!-- REQUIRED FOR SYSTEM WIDE CHANGES -->
+* Policies and guidelines: [[PackageMaintainers/PKCS11]] needs changes basically to eliminate NSS specific stuff <!-- REQUIRED FOR SYSTEM WIDE CHANGES -->
 <!-- Do the packaging guidelines or other documents need to be updated for this feature?  If so, does it need to happen before or after the implementation is done?  If a FPC ticket exists, add a link here. -->
@@ Line 122: / Line 65: @@
 <!-- REQUIRED FOR SYSTEM WIDE CHANGES -->
-If the user previously used a conflicting configuration, such as using p11-kit-proxy as a replacement of p11-kit-trust, it will stop working.
+Uncommon/undocumented scenarios may be affected, in particular if the user previously used a configuration which conflicts with this change. In addition to that, support for the third party / proprietary PKCS#11 modules is out of scope of this proposal. That is, if the user had previously installed a p11-kit configuration file for such modules, it could stop working. Even then, she can remove the configuration file and manually register the module through the application (e.g., Firefox's preferences).
+* [https://bugzilla.redhat.com/show_bug.cgi?id=1745920 bugzilla.redhat.com - 2019-08-27 p11-kit-trust breaks pkcs11 client-certificate authentication with Firefox]
 == How To Test ==
@@ Line 140: / Line 85: @@
 <!-- REQUIRED FOR SYSTEM WIDE CHANGES -->
-# install a PKCS#11 module, say softhsm2
+# Install a PKCS#11 module, say [https://src.fedoraproject.org/rpms/softhsm softhsm] or [https://src.fedoraproject.org/rpms/opensc opensc]. These modules should be ready to use after installing the packages with DNF. To use them as HSM you need to initialize a token with softhsm2-util or attach a hardware device supported by OpenSC, such as Nitrokey (see the [https://github.com/OpenSC/OpenSC/wiki wiki] for details).
-# create an NSS database
+# Start Firefox and check if the module is listed in Preferences -> Privacy & Security -> Security Devices...
-# list modules registered to the NSS database, and check that there is softhsm2
+# Create an NSS database: certutil -d sql:nssdb -N --empty-password
+# List modules registered to the NSS database: modutil -dbdir sql:nssdb -list
+# Check that the output includes the PKCS#11 module installed on the step 1:
+    Listing of PKCS #11 Modules
+    -----------------------------------------------------------
+. NSS Internal PKCS #11 Module
+    	   uri: pkcs11:library-manufacturer=Mozilla%20Foundation;library-description=NSS%20Internal%20Crypto%20Services;library-version=3.36
+    	 slots: 2 slots attached
+    	status: loaded
+    [...]
+. p11-kit-proxy
+    	library name: p11-kit-proxy.so
+    	   uri: pkcs11:library-manufacturer=PKCS%2311%20Kit;library-description=PKCS%2311%20Kit%20Proxy%20Module;library-version=1.1
+    	 slots: 5 slots attached
+    	status: loaded
+    [...]
+    	 slot: SoftHSM slot ID 0x0
+    	token:
+    	  uri: pkcs11:manufacturer=SoftHSM%20project;model=SoftHSM%20v2
+    -----------------------------------------------------------
 == User Experience ==
@@ Line 155: / Line 121: @@
   - Green has been scientifically proven to be the most relaxing color. The move to a default background color of green with green text will result in Fedora users being the most relaxed users of any operating system.
 -->
-NSS application users are no longer required to register PKCS#11 module manually.
+The users of NSS applications (e.g. firefox and sssd) would be able to use supported smartcards and HSMs without further configuration.
 == Dependencies ==
@@ Line 161: / Line 127: @@
 <!-- REQUIRED FOR SYSTEM WIDE CHANGES -->
-firefox, sssd
+firefox, and possibly sssd's smartcard support
 == Contingency Plan ==
-<!-- If you cannot complete your feature by the final development freeze, what is the backup plan?  This might be as simple as "Revert the shipped configuration".  Or it might not (e.g. rebuilding a number of dependent packages).  If you feature is not completed in time we want to assure others that other parts of Fedora will not be in jeopardy.  -->
+* Contingency mechanism: Revert the change in nss, p11-kit, or crypto-policies  <!-- REQUIRED FOR SYSTEM WIDE CHANGES -->
-* Contingency mechanism: Revert the change in crypto-policies  <!-- REQUIRED FOR SYSTEM WIDE CHANGES -->
 <!-- When is the last time the contingency mechanism can be put in place?  This will typically be the beta freeze. -->
 * Contingency deadline: Beta freeze  <!-- REQUIRED FOR SYSTEM WIDE CHANGES -->
@@ Line 177: / Line 142: @@
 <!-- REQUIRED FOR SYSTEM WIDE CHANGES -->
-N/A
+No new documentation needed, but the existing documentation should be modified to remove the special cases of NSS.
 == Release Notes ==
@@ Line 185: / Line 150: @@
 Release Notes are not required for initial draft of the Change Proposal but has to be completed by the Change Freeze.
 -->
-It should be sufficient to have a simple sentence mentioning this change.
+It should be sufficient to have a simple sentence mentioning this change and how to opt-out from it.
+* Release Notes tracking: [https://pagure.io/fedora-docs/release-notes/issue/184 #184]
-[[Category:ChangePageIncomplete]]
+[[Category:ChangeAcceptedF29]]
 <!-- When your change proposal page is completed and ready for review and announcement -->
 <!-- remove Category:ChangePageIncomplete and change it to Category:ChangeReadyForWrangler -->

Search

Changes/NSSLoadP11KitModules: Difference between revisions