Revision as of 06:23, 2 June 2018

NSS load p11-kit modules by default

Summary

When NSS database is created, the PKCS#11 modules configured in the system's p11-kit will be automatically registered and visible to NSS applications.

Owner

Name: Daiki Ueno
Email: dueno@redhat.com
Release notes owner:

Current status

Targeted release: Fedora 29
Last updated: 2018-06-02
Tracker bug: <will be assigned by the Wrangler>

Detailed Description

Although Fedora provides a mechanism to configure PKCS#11 modules system wide, allowing the crypto libraries (GnuTLS and OpenSSL) to use PKCS#11 modules in a consistent manner, NSS applications didn't benefit from it as it uses different configuration mechanism which requires users to register PKCS#11 modules with modutil. This change makes the p11-kit-proxy module (the aggregator of the system PKCS#11 modules) be automatically loaded by NSS and thus provides a consistent user experience with other crypto libraries.

Benefit to Fedora

This change allows NSS applications to use PKCS#11 modules in a consistent manner with other crypto libraries.

Scope

Proposal owners:
- Modify the crypto-policies package to enable p11-kit-proxy in the newly created NSS database.
- Make sure that this change doesn't cause any regression with the existing applications.

Other developers: N/A (not a System Wide Change)

Release engineering: #Releng issue number (a check of an impact with Release Engineering is needed)
- List of deliverables: N/A

Policies and guidelines: PackageMaintainers/PKCS11 needs changes basically to eliminate NSS specific stuff

Trademark approval: N/A (not needed for this Change)

Upgrade/compatibility impact

If the user previously used a conflicting configuration, such as using p11-kit-proxy as a replacement of p11-kit-trust, it will stop working.

How To Test

install a PKCS#11 module, say softhsm2
create an NSS database
list modules registered to the NSS database, and check that there is softhsm2

User Experience

NSS application users are no longer required to register PKCS#11 module manually.

Dependencies

firefox, and possibly sssd's smartcard support

Contingency Plan

Contingency mechanism: Revert the change in crypto-policies
Contingency deadline: Beta freeze
Blocks release? No
Blocks product? No

Documentation

N/A

Release Notes

It should be sufficient to have a simple sentence mentioning this change.

@@ Line 1: / Line 1: @@
-<!-- Self Contained or System Wide Change Proposal?
+= NSS load p11-kit modules by default =
-Use this guide to determine to which category your proposed change belongs to.
-Self Contained Changes are:
-* changes to isolated/leaf package without the impact on other packages/rest of the distribution
-* limited scope changes without the impact on other packages/rest of the distribution
-* coordinated effort within SIG with limited impact outside SIG functional area, accepted by the SIG
-System Wide Changes are:
-* changes that does not fit Self Contained Changes category touching
-* changes that require coordination within the distribution (for example mass rebuilds, release engineering or other teams effort etc.)
-* changing system defaults
-For Self Contained Changes, sections marked as "REQUIRED FOR SYSTEM WIDE CHANGES" are OPTIONAL but FESCo/Wrangler can request more details (especially in case the change proposal category is
-improper or updated to System Wide category). For System Wide Changes all fields on this form are required for FESCo acceptance (when applies).
-We request that you maintain the same order of sections so that all of the change proposal pages are uniform.
--->
-<!-- The actual name of your proposed change page should look something like: Changes/Your_Change_Proposal_Name.  This keeps all change proposals in the same namespace -->
-<!-- The actual name of your proposed change page should look something like: Changes/Your_Change_Proposal_Name.  This keeps all change proposals in the same namespace -->
-= NSS load p11-kit modules by default <!-- The name of your change proposal --> =
 == Summary ==
-<!-- A sentence or two summarizing what this change is and what it will do. This information is used for the overall changeset summary page for each release.
+When NSS database is created, the PKCS#11 modules configured in the system's p11-kit will be automatically registered and visible to NSS applications.
-Note that motivation for the change should be in the Motivation section below, and this part should answer the question "What?" rather than "Why?". -->
-When NSS database is created, the PKCS#11 modules configured in the system's p11-kit will be automatically registered and visible to applications.
 == Owner ==
-<!--
-For change proposals to qualify as self-contained, owners of all affected packages need to be included here. Alternatively, a SIG can be listed as an owner if it owns all affected packages.
-This should link to your home wiki page so we know who you are.
--->
 * Name: [[User:Ueno| Daiki Ueno]]
-<!-- Include you email address that you can be reached should people want to contact you about helping with your change, status is requested, or technical issues need to be resolved. If the change proposal is owned by a SIG, please also add a primary contact person. -->
 * Email: dueno@redhat.com
 * Release notes owner: <!--- To be assigned by docs team [[User:FASAccountName| Release notes owner name]] <email address> -->
@@ Line 60: / Line 31: @@
 == Detailed Description ==
-<!-- Expand on the summary, if appropriate.  A couple sentences suffices to explain the goal, but the more details you can provide the better. -->
+Although Fedora provides a mechanism to configure PKCS#11 modules system wide, allowing the crypto libraries (GnuTLS and OpenSSL) to use PKCS#11 modules in a consistent manner, NSS applications didn't benefit from it as it uses different configuration mechanism which requires users to register PKCS#11 modules with modutil. This change makes the p11-kit-proxy module (the aggregator of the system PKCS#11 modules) be automatically loaded by NSS and thus provides a consistent user experience with other crypto libraries.
-While Fedora provides a way of configuring PKCS#11 modules on the system through p11-kit, NSS applications by default didn't benefit from it and the users had to register necessary modules with modutil manually.  Making NSS also aware of the system configuration will bring them a consistent user experience regarding PKCS#11 and smartcards.
 See also:
@@ Line 68: / Line 38: @@
 == Benefit to Fedora ==
-<!-- What is the benefit to the distribution?  Will the software we generate be improved? How will the process of creating Fedora releases be improved?
+This change allows NSS applications to use PKCS#11 modules in a consistent manner with other crypto libraries.
-      Be sure to include the following areas if relevant:
-      If this is a major capability update, what has changed?
-           For example: This change introduces Python 5 that runs without the Global Interpreter Lock and is fully multithreaded.
-      If this is a new functionality, what capabilities does it bring?
-           For example: This change allows package upgrades to be performed automatically and rolled-back at will.
-      Does this improve some specific package or set of packages?
-           For example: This change modifies a package to use a different language stack that reduces install size by removing dependencies.
-      Does this improve specific Spins or Editions?
-           For example: This change modifies the default install of Fedora Workstation to be more in line with the base install of Fedora Server.
-      Does this make the distribution more efficient?
-           For example: This change replaces thousands of individual %post scriptlets in packages with one script that runs at the end.
-      Is this an improvement to maintainer processes?
-           For example: Gating Fedora packages on automatic QA tests will make rawhide more stable and allow changes to be implemented more smoothly.
-      Is this an improvement targeted as specific contributors?
-           For example: Ensuring that a minimal set of tools required for contribution to Fedora are installed by default eases the onboarding of new contributors.
-     When a Change has multiple benefits, it's better to list them all.
-     Consider these Change pages from previous editions as inspiration:
-     https://fedoraproject.org/wiki/Changes/Annobin (low-level and technical, invisible to users)
-     https://fedoraproject.org/wiki/Changes/ParallelInstallableDebuginfo (low-level, but visible to advanced users)
-     https://fedoraproject.org/wiki/Changes/VirtualBox_Guest_Integration (primarily a UX change)
-     https://fedoraproject.org/wiki/Changes/NoMoreAlpha (an improvement to distro processes)
-     https://fedoraproject.org/wiki/Changes/perl5.26 (major upgrade to a popular software stack, visible to users of that stack)
--->
-NSS applications can use PKCS#11 modules without special configuration procedure to NSS.
 == Scope ==
 * Proposal owners:
 <!-- What work do the feature owners have to accomplish to complete the feature in time for release?  Is it a large change affecting many parts of the distribution or is it a very isolated change? What are those changes?-->
-- Modify the crypto-policies package to enable p11-kit-proxy in the newly created NSS database.
+** Modify the crypto-policies package to enable p11-kit-proxy in the newly created NSS database.
-- Make sure that this change doesn't cause any regression with the existing applications.
+** Make sure that this change doesn't cause any regression with the existing applications.
 * Other developers: N/A (not a System Wide Change) <!-- REQUIRED FOR SYSTEM WIDE CHANGES -->
@@ Line 112: / Line 55: @@
 <!-- Please check the list of Fedora release deliverables and list all the differences the feature brings -->
-* Policies and guidelines: [[PackageMaintainers/PKCS11]] <!-- REQUIRED FOR SYSTEM WIDE CHANGES -->
+* Policies and guidelines: [[PackageMaintainers/PKCS11]] needs changes basically to eliminate NSS specific stuff <!-- REQUIRED FOR SYSTEM WIDE CHANGES -->
 <!-- Do the packaging guidelines or other documents need to be updated for this feature?  If so, does it need to happen before or after the implementation is done?  If a FPC ticket exists, add a link here. -->
@@ Line 161: / Line 104: @@
 <!-- REQUIRED FOR SYSTEM WIDE CHANGES -->
-firefox, sssd
+firefox, and possibly sssd's smartcard support
 == Contingency Plan ==
-<!-- If you cannot complete your feature by the final development freeze, what is the backup plan?  This might be as simple as "Revert the shipped configuration".  Or it might not (e.g. rebuilding a number of dependent packages).  If you feature is not completed in time we want to assure others that other parts of Fedora will not be in jeopardy.  -->
 * Contingency mechanism: Revert the change in crypto-policies  <!-- REQUIRED FOR SYSTEM WIDE CHANGES -->
 <!-- When is the last time the contingency mechanism can be put in place?  This will typically be the beta freeze. -->

Search

Changes/NSSLoadP11KitModules: Difference between revisions