< Changes
mNo edit summary |
mNo edit summary |
||
| Line 44: | Line 44: | ||
** Enable p11-kit-proxy in the newly created NSS database, through the crypto-policies package. | ** Enable p11-kit-proxy in the newly created NSS database, through the crypto-policies package. | ||
** Modify the opensc package not to register itself to the NSS database upon installation. | ** Modify the opensc package not to register itself to the NSS database upon installation. | ||
* Other developers: | * Other developers: | ||
** | ** Make sure that this change doesn't cause any regression with the existing applications. | ||
* Release engineering: [https://pagure.io/releng/issues #Releng issue number] (a check of an impact with Release Engineering is needed) <!-- REQUIRED FOR SYSTEM WIDE AS WELL AS FOR SELF CONTAINED CHANGES --> | * Release engineering: [https://pagure.io/releng/issues #Releng issue number] (a check of an impact with Release Engineering is needed) <!-- REQUIRED FOR SYSTEM WIDE AS WELL AS FOR SELF CONTAINED CHANGES --> | ||
| Line 83: | Line 82: | ||
<!-- REQUIRED FOR SYSTEM WIDE CHANGES --> | <!-- REQUIRED FOR SYSTEM WIDE CHANGES --> | ||
# install a PKCS#11 module, say | # install a PKCS#11 module, say [https://src.fedoraproject.org/rpms/softhsm softhsm] | ||
# create an NSS database | # create an NSS database | ||
# list modules registered to the NSS database, and check that there is | # list modules registered to the NSS database, and check that there is softhsm | ||
== User Experience == | == User Experience == | ||
| Line 108: | Line 107: | ||
== Contingency Plan == | == Contingency Plan == | ||
* Contingency mechanism: Revert the change in crypto-policies <!-- REQUIRED FOR SYSTEM WIDE CHANGES --> | * Contingency mechanism: Revert the change in nss, p11-kit, or crypto-policies <!-- REQUIRED FOR SYSTEM WIDE CHANGES --> | ||
<!-- When is the last time the contingency mechanism can be put in place? This will typically be the beta freeze. --> | <!-- When is the last time the contingency mechanism can be put in place? This will typically be the beta freeze. --> | ||
* Contingency deadline: Beta freeze <!-- REQUIRED FOR SYSTEM WIDE CHANGES --> | * Contingency deadline: Beta freeze <!-- REQUIRED FOR SYSTEM WIDE CHANGES --> | ||
| Line 119: | Line 118: | ||
<!-- REQUIRED FOR SYSTEM WIDE CHANGES --> | <!-- REQUIRED FOR SYSTEM WIDE CHANGES --> | ||
No new documentation, but the existing documentation | No new documentation needed, but the existing documentation should be modified to remove the special cases of NSS. | ||
== Release Notes == | == Release Notes == | ||
Revision as of 11:38, 4 June 2018
NSS load p11-kit modules by default
Summary
When NSS database is created, PKCS#11 modules configured in the system's p11-kit will be automatically registered and visible to NSS applications.
Owner
- Name: Daiki Ueno
- Email: dueno@redhat.com
- Release notes owner:
Current status
- Targeted release: Fedora 29
- Last updated: 2018-06-04
- Tracker bug: <will be assigned by the Wrangler>
Detailed Description
Fedora provides a mechanism to configure PKCS#11 modules system wide, allowing the crypto libraries (GnuTLS and OpenSSL) to use PKCS#11 modules in a consistent manner. Until now NSS applications haven't benefit from it as NSS uses a different configuration mechanism which requires users to register PKCS#11 modules in NSS databases. This change makes the manual procedure unnecessary, by registering the p11-kit-proxy module (the aggregator of the system PKCS#11 modules) in NSS databases with the default configuration.
See also:
Benefit to Fedora
This change allows NSS applications to use PKCS#11 modules in the same way as other crypto libraries, bringing consistency in PKCS#11 driver registration across the OS. That improves user experience of smartcards and HSMs on Fedora.
Scope
- Proposal owners:
- Enable p11-kit-proxy in the newly created NSS database, through the crypto-policies package.
- Modify the opensc package not to register itself to the NSS database upon installation.
- Other developers:
- Make sure that this change doesn't cause any regression with the existing applications.
- Release engineering: #Releng issue number (a check of an impact with Release Engineering is needed)
- List of deliverables: N/A
- Policies and guidelines: PackageMaintainers/PKCS11 needs changes basically to eliminate NSS specific stuff
- Trademark approval: N/A (not needed for this Change)
Upgrade/compatibility impact
Uncommon/undocumented scenarios may be affected, in particular if the user previously used a configuration which conflicts with this change.
How To Test
- install a PKCS#11 module, say softhsm
- create an NSS database
- list modules registered to the NSS database, and check that there is softhsm
User Experience
The users of NSS applications (e.g. firefox and sssd) would be able to use supported smartcards and HSMs without further configuration.
Dependencies
firefox, and possibly sssd's smartcard support
Contingency Plan
- Contingency mechanism: Revert the change in nss, p11-kit, or crypto-policies
- Contingency deadline: Beta freeze
- Blocks release? No
- Blocks product? No
Documentation
No new documentation needed, but the existing documentation should be modified to remove the special cases of NSS.
Release Notes
It should be sufficient to have a simple sentence mentioning this change and how to opt-opt from it.