From Fedora Project Wiki
mNo edit summary
 
(19 intermediate revisions by 2 users not shown)
Line 2: Line 2:


== Summary ==
== Summary ==
When NSS database is created, the PKCS#11 modules configured in the system's p11-kit will be automatically registered and visible to NSS applications.
When NSS database is created, PKCS#11 modules configured in the system's p11-kit will be automatically registered and visible to NSS applications.


== Owner ==
== Owner ==
Line 27: Line 27:
CLOSED as NEXTRELEASE -> change is completed and verified and will be delivered in next release under development
CLOSED as NEXTRELEASE -> change is completed and verified and will be delivered in next release under development
-->
-->
* Tracker bug: <will be assigned by the Wrangler>
* Tracker bug: [https://bugzilla.redhat.com/show_bug.cgi?id=1592206 #1592206]
* Release Notes tracking: [https://pagure.io/fedora-docs/release-notes/issue/184 #184]


== Detailed Description ==
== Detailed Description ==


Although Fedora provides a mechanism to configure PKCS#11 modules system wide, allowing the crypto libraries (GnuTLS and OpenSSL) to use PKCS#11 modules in a consistent manner, NSS applications didn't benefit from it as it uses a different configuration mechanism which requires users to register PKCS#11 modules with modutil. This change makes the p11-kit-proxy module (the aggregator of the system PKCS#11 modules) be automatically loaded by NSS and thus provides a consistent user experience with other crypto libraries.
Fedora provides a mechanism to configure PKCS#11 modules system wide, allowing the crypto libraries (GnuTLS and OpenSSL) to use PKCS#11 modules in a consistent manner. Until now NSS applications haven't benefit from it as NSS uses a different configuration mechanism which requires users to register PKCS#11 modules in NSS databases. This change makes the manual procedure unnecessary, by registering the p11-kit-proxy module (the aggregator of the system PKCS#11 modules) in NSS databases with the default configuration.


See also:
See also:
Line 38: Line 39:
== Benefit to Fedora ==
== Benefit to Fedora ==


This change allows NSS applications to use PKCS#11 modules in a consistent manner with other crypto libraries.
This change allows NSS applications to use PKCS#11 modules in the same way as other crypto libraries, bringing consistency in PKCS#11 driver registration across the OS.  That improves user experience of smartcards and HSMs on Fedora.


== Scope ==
== Scope ==
* Proposal owners:
* Proposal owners:
<!-- What work do the feature owners have to accomplish to complete the feature in time for release?  Is it a large change affecting many parts of the distribution or is it a very isolated change? What are those changes?-->
** Enable p11-kit-proxy in the newly created NSS database, through the crypto-policies package.
** Modify the crypto-policies package to enable p11-kit-proxy in the newly created NSS database.
** Modify the opensc package not to register itself to the NSS database upon installation.
 
* Other developers:
** Make sure that this change doesn't cause any regression with the existing applications.
** Make sure that this change doesn't cause any regression with the existing applications.


* Other developers: N/A (not a System Wide Change) <!-- REQUIRED FOR SYSTEM WIDE CHANGES -->
* Release engineering: [https://pagure.io/releng/issue/7548 #7548] <!-- REQUIRED FOR SYSTEM WIDE AS WELL AS FOR SELF CONTAINED CHANGES -->
<!-- What work do other developers have to accomplish to complete the feature in time for release?  Is it a large change affecting many parts of the distribution or is it a very isolated change? What are those changes?-->
 
* Release engineering: [https://pagure.io/releng/issues #Releng issue number] (a check of an impact with Release Engineering is needed) <!-- REQUIRED FOR SYSTEM WIDE AS WELL AS FOR SELF CONTAINED CHANGES -->
<!-- Does this feature require coordination with release engineering (e.g. changes to installer image generation or update package delivery)?  Is a mass rebuild required?  include a link to the releng issue.  
<!-- Does this feature require coordination with release engineering (e.g. changes to installer image generation or update package delivery)?  Is a mass rebuild required?  include a link to the releng issue.  
The issue is required to be filed prior to feature submission, to ensure that someone is on board to do any process development work and testing, and that all changes make it into the pipeline; a bullet point in a change is not sufficient communication -->
The issue is required to be filed prior to feature submission, to ensure that someone is on board to do any process development work and testing, and that all changes make it into the pipeline; a bullet point in a change is not sufficient communication -->
Line 65: Line 65:


<!-- REQUIRED FOR SYSTEM WIDE CHANGES -->
<!-- REQUIRED FOR SYSTEM WIDE CHANGES -->
If the user previously used a conflicting configuration, such as using p11-kit-proxy as a replacement of p11-kit-trust, it will stop working.
Uncommon/undocumented scenarios may be affected, in particular if the user previously used a configuration which conflicts with this change. In addition to that, support for the third party / proprietary PKCS#11 modules is out of scope of this proposal. That is, if the user had previously installed a p11-kit configuration file for such modules, it could stop working. Even then, she can remove the configuration file and manually register the module through the application (e.g., Firefox's preferences).
 
* [https://bugzilla.redhat.com/show_bug.cgi?id=1745920 bugzilla.redhat.com - 2019-08-27 p11-kit-trust breaks pkcs11 client-certificate authentication with Firefox]


== How To Test ==
== How To Test ==
Line 83: Line 85:


<!-- REQUIRED FOR SYSTEM WIDE CHANGES -->
<!-- REQUIRED FOR SYSTEM WIDE CHANGES -->
# install a PKCS#11 module, say softhsm2
# Install a PKCS#11 module, say [https://src.fedoraproject.org/rpms/softhsm softhsm] or [https://src.fedoraproject.org/rpms/opensc opensc]. These modules should be ready to use after installing the packages with DNF. To use them as HSM you need to initialize a token with softhsm2-util or attach a hardware device supported by OpenSC, such as Nitrokey (see the [https://github.com/OpenSC/OpenSC/wiki wiki] for details).
# create an NSS database
# Start Firefox and check if the module is listed in Preferences -> Privacy & Security -> Security Devices...
# list modules registered to the NSS database, and check that there is softhsm2
# Create an NSS database: certutil -d sql:nssdb -N --empty-password
# List modules registered to the NSS database: modutil -dbdir sql:nssdb -list
# Check that the output includes the PKCS#11 module installed on the step 1:
    Listing of PKCS #11 Modules
    -----------------------------------------------------------
      1. NSS Internal PKCS #11 Module
      uri: pkcs11:library-manufacturer=Mozilla%20Foundation;library-description=NSS%20Internal%20Crypto%20Services;library-version=3.36
    slots: 2 slots attached
    status: loaded
   
    [...]
   
      2. p11-kit-proxy
    library name: p11-kit-proxy.so
      uri: pkcs11:library-manufacturer=PKCS%2311%20Kit;library-description=PKCS%2311%20Kit%20Proxy%20Module;library-version=1.1
    slots: 5 slots attached
    status: loaded
    [...]
    slot: SoftHSM slot ID 0x0
    token:
      uri: pkcs11:manufacturer=SoftHSM%20project;model=SoftHSM%20v2
    -----------------------------------------------------------


== User Experience ==
== User Experience ==
Line 98: Line 121:
  - Green has been scientifically proven to be the most relaxing color. The move to a default background color of green with green text will result in Fedora users being the most relaxed users of any operating system.
  - Green has been scientifically proven to be the most relaxing color. The move to a default background color of green with green text will result in Fedora users being the most relaxed users of any operating system.
-->
-->
NSS application users are no longer required to register PKCS#11 module manually.  
The users of NSS applications (e.g. firefox and sssd) would be able to use supported smartcards and HSMs without further configuration.  


== Dependencies ==
== Dependencies ==
Line 108: Line 131:
== Contingency Plan ==
== Contingency Plan ==


* Contingency mechanism: Revert the change in crypto-policies  <!-- REQUIRED FOR SYSTEM WIDE CHANGES -->
* Contingency mechanism: Revert the change in nss, p11-kit, or crypto-policies  <!-- REQUIRED FOR SYSTEM WIDE CHANGES -->
<!-- When is the last time the contingency mechanism can be put in place?  This will typically be the beta freeze. -->
<!-- When is the last time the contingency mechanism can be put in place?  This will typically be the beta freeze. -->
* Contingency deadline: Beta freeze  <!-- REQUIRED FOR SYSTEM WIDE CHANGES -->
* Contingency deadline: Beta freeze  <!-- REQUIRED FOR SYSTEM WIDE CHANGES -->
Line 119: Line 142:


<!-- REQUIRED FOR SYSTEM WIDE CHANGES -->
<!-- REQUIRED FOR SYSTEM WIDE CHANGES -->
N/A
No new documentation needed, but the existing documentation should be modified to remove the special cases of NSS.


== Release Notes ==
== Release Notes ==
Line 127: Line 150:
Release Notes are not required for initial draft of the Change Proposal but has to be completed by the Change Freeze.  
Release Notes are not required for initial draft of the Change Proposal but has to be completed by the Change Freeze.  
-->
-->
It should be sufficient to have a simple sentence mentioning this change.
It should be sufficient to have a simple sentence mentioning this change and how to opt-out from it.
* Release Notes tracking: [https://pagure.io/fedora-docs/release-notes/issue/184 #184]


[[Category:ChangePageIncomplete]]
[[Category:ChangeAcceptedF29]]
<!-- When your change proposal page is completed and ready for review and announcement -->
<!-- When your change proposal page is completed and ready for review and announcement -->
<!-- remove Category:ChangePageIncomplete and change it to Category:ChangeReadyForWrangler -->
<!-- remove Category:ChangePageIncomplete and change it to Category:ChangeReadyForWrangler -->

Latest revision as of 06:56, 29 August 2019

NSS load p11-kit modules by default

Summary

When NSS database is created, PKCS#11 modules configured in the system's p11-kit will be automatically registered and visible to NSS applications.

Owner

  • Name: Daiki Ueno
  • Email: dueno@redhat.com
  • Release notes owner:

Current status

Detailed Description

Fedora provides a mechanism to configure PKCS#11 modules system wide, allowing the crypto libraries (GnuTLS and OpenSSL) to use PKCS#11 modules in a consistent manner. Until now NSS applications haven't benefit from it as NSS uses a different configuration mechanism which requires users to register PKCS#11 modules in NSS databases. This change makes the manual procedure unnecessary, by registering the p11-kit-proxy module (the aggregator of the system PKCS#11 modules) in NSS databases with the default configuration.

See also:

Benefit to Fedora

This change allows NSS applications to use PKCS#11 modules in the same way as other crypto libraries, bringing consistency in PKCS#11 driver registration across the OS. That improves user experience of smartcards and HSMs on Fedora.

Scope

  • Proposal owners:
    • Enable p11-kit-proxy in the newly created NSS database, through the crypto-policies package.
    • Modify the opensc package not to register itself to the NSS database upon installation.
  • Other developers:
    • Make sure that this change doesn't cause any regression with the existing applications.
  • Trademark approval: N/A (not needed for this Change)

Upgrade/compatibility impact

Uncommon/undocumented scenarios may be affected, in particular if the user previously used a configuration which conflicts with this change. In addition to that, support for the third party / proprietary PKCS#11 modules is out of scope of this proposal. That is, if the user had previously installed a p11-kit configuration file for such modules, it could stop working. Even then, she can remove the configuration file and manually register the module through the application (e.g., Firefox's preferences).

How To Test

  1. Install a PKCS#11 module, say softhsm or opensc. These modules should be ready to use after installing the packages with DNF. To use them as HSM you need to initialize a token with softhsm2-util or attach a hardware device supported by OpenSC, such as Nitrokey (see the wiki for details).
  2. Start Firefox and check if the module is listed in Preferences -> Privacy & Security -> Security Devices...
  3. Create an NSS database: certutil -d sql:nssdb -N --empty-password
  4. List modules registered to the NSS database: modutil -dbdir sql:nssdb -list
  5. Check that the output includes the PKCS#11 module installed on the step 1:
   Listing of PKCS #11 Modules
   -----------------------------------------------------------
     1. NSS Internal PKCS #11 Module
   	   uri: pkcs11:library-manufacturer=Mozilla%20Foundation;library-description=NSS%20Internal%20Crypto%20Services;library-version=3.36
   	 slots: 2 slots attached
   	status: loaded
   
   [...]
   
     2. p11-kit-proxy
   	library name: p11-kit-proxy.so
   	   uri: pkcs11:library-manufacturer=PKCS%2311%20Kit;library-description=PKCS%2311%20Kit%20Proxy%20Module;library-version=1.1
   	 slots: 5 slots attached
   	status: loaded
   [...]
   	 slot: SoftHSM slot ID 0x0
   	token: 
   	  uri: pkcs11:manufacturer=SoftHSM%20project;model=SoftHSM%20v2
   -----------------------------------------------------------

User Experience

The users of NSS applications (e.g. firefox and sssd) would be able to use supported smartcards and HSMs without further configuration.

Dependencies

firefox, and possibly sssd's smartcard support

Contingency Plan

  • Contingency mechanism: Revert the change in nss, p11-kit, or crypto-policies
  • Contingency deadline: Beta freeze
  • Blocks release? No
  • Blocks product? No

Documentation

No new documentation needed, but the existing documentation should be modified to remove the special cases of NSS.

Release Notes

It should be sufficient to have a simple sentence mentioning this change and how to opt-out from it.

  • Release Notes tracking: #184
Retrieved from "https://fedoraproject.org/w/index.php?title=Changes/NSSLoadP11KitModules&oldid=551090"