From Fedora Project Wiki
(mention opensc in scope)
Line 38: Line 38:
 
== Benefit to Fedora ==
 
== Benefit to Fedora ==
  
This change allows NSS applications to use PKCS#11 modules in the same way as other crypto libraries.  That improves user experience of smartcards and HSMs on Fedora.
+
This change allows NSS applications to use PKCS#11 modules in the same way as other crypto libraries, bringing consistency in PKCS#11 driver registration across the OS.  That improves user experience of smartcards and HSMs on Fedora.
  
 
== Scope ==
 
== Scope ==
 
* Proposal owners:
 
* Proposal owners:
 
<!-- What work do the feature owners have to accomplish to complete the feature in time for release?  Is it a large change affecting many parts of the distribution or is it a very isolated change? What are those changes?-->
 
<!-- What work do the feature owners have to accomplish to complete the feature in time for release?  Is it a large change affecting many parts of the distribution or is it a very isolated change? What are those changes?-->
** Modify the crypto-policies package to enable p11-kit-proxy in the newly created NSS database.
+
** Enable p11-kit-proxy in the newly created NSS database, through the crypto-policies package.
 
** Modify the opensc package not to register itself to the NSS database upon installation.
 
** Modify the opensc package not to register itself to the NSS database upon installation.
 
** Make sure that this change doesn't cause any regression with the existing applications.
 
** Make sure that this change doesn't cause any regression with the existing applications.
Line 66: Line 66:
  
 
<!-- REQUIRED FOR SYSTEM WIDE CHANGES -->
 
<!-- REQUIRED FOR SYSTEM WIDE CHANGES -->
If the user previously used a conflicting configuration, such as using p11-kit-proxy as a replacement of p11-kit-trust, it will stop working.
+
Uncommon/undocumented scenarios may be affected, in particular if the user previously used a configuration which conflicts with this change.
  
 
== How To Test ==
 
== How To Test ==
Line 99: Line 99:
 
  - Green has been scientifically proven to be the most relaxing color. The move to a default background color of green with green text will result in Fedora users being the most relaxed users of any operating system.
 
  - Green has been scientifically proven to be the most relaxing color. The move to a default background color of green with green text will result in Fedora users being the most relaxed users of any operating system.
 
-->
 
-->
NSS application users are no longer required to register PKCS#11 module manually.  
+
The users of NSS applications (e.g. firefox and sssd) would be able to use supported smartcards and HSMs without further configuration.  
  
 
== Dependencies ==
 
== Dependencies ==
Line 120: Line 120:
  
 
<!-- REQUIRED FOR SYSTEM WIDE CHANGES -->
 
<!-- REQUIRED FOR SYSTEM WIDE CHANGES -->
None (the existing documentation needs to be changed to not mention the special case of NSS)
+
No new documentation, but the existing documentation needs to be changed to not mention the special case of NSS.
  
 
== Release Notes ==
 
== Release Notes ==
Line 128: Line 128:
 
Release Notes are not required for initial draft of the Change Proposal but has to be completed by the Change Freeze.  
 
Release Notes are not required for initial draft of the Change Proposal but has to be completed by the Change Freeze.  
 
-->
 
-->
It should be sufficient to have a simple sentence mentioning this change.
+
It should be sufficient to have a simple sentence mentioning this change and how to opt-opt from it.
  
 
[[Category:ChangePageIncomplete]]
 
[[Category:ChangePageIncomplete]]

Revision as of 08:42, 4 June 2018

NSS load p11-kit modules by default

Summary

When NSS database is created, PKCS#11 modules configured in the system's p11-kit will be automatically registered and visible to NSS applications.

Owner

  • Name: Daiki Ueno
  • Email: dueno@redhat.com
  • Release notes owner:

Current status

  • Targeted release: Fedora 29
  • Last updated: 2018-06-04
  • Tracker bug: <will be assigned by the Wrangler>

Detailed Description

Fedora provides a mechanism to configure PKCS#11 modules system wide, allowing the crypto libraries (GnuTLS and OpenSSL) to use PKCS#11 modules in a consistent manner. Until now NSS applications haven't benefit from it as NSS uses a different configuration mechanism which requires users to register PKCS#11 modules in NSS databases. This change makes the manual procedure unnecessary, by registering the p11-kit-proxy module (the aggregator of the system PKCS#11 modules) in NSS databases with the default configuration.

See also:

Benefit to Fedora

This change allows NSS applications to use PKCS#11 modules in the same way as other crypto libraries, bringing consistency in PKCS#11 driver registration across the OS. That improves user experience of smartcards and HSMs on Fedora.

Scope

  • Proposal owners:
    • Enable p11-kit-proxy in the newly created NSS database, through the crypto-policies package.
    • Modify the opensc package not to register itself to the NSS database upon installation.
    • Make sure that this change doesn't cause any regression with the existing applications.
  • Other developers: N/A (not a System Wide Change)
  • Trademark approval: N/A (not needed for this Change)

Upgrade/compatibility impact

Uncommon/undocumented scenarios may be affected, in particular if the user previously used a configuration which conflicts with this change.

How To Test

  1. install a PKCS#11 module, say softhsm2
  2. create an NSS database
  3. list modules registered to the NSS database, and check that there is softhsm2

User Experience

The users of NSS applications (e.g. firefox and sssd) would be able to use supported smartcards and HSMs without further configuration.

Dependencies

firefox, and possibly sssd's smartcard support

Contingency Plan

  • Contingency mechanism: Revert the change in crypto-policies
  • Contingency deadline: Beta freeze
  • Blocks release? No
  • Blocks product? No

Documentation

No new documentation, but the existing documentation needs to be changed to not mention the special case of NSS.

Release Notes

It should be sufficient to have a simple sentence mentioning this change and how to opt-opt from it.