Do not let tmpfiles.d create the token specific directories inside
/var/lock/opencryptoki/. It is not known during build time which tokens
will exist later during run time. A user may configure any number of
tokens with any names in /etc/opencryptoki/opencryptoki.conf.
The API layer will create any non-existing token specific lock directories
inside /var/lock/opencryptoki/ during C_Initialize() as needed.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Allow to specify the pkcsslotd user and the pkcs11 group during
configuration.
Use '--with-pkcsslotd-user=USER' and/or '--with-pkcs-group=GROUP'
to specify the user and group name. The defaults are 'pkcsslotd'
and 'pkcs11'.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Use various sandboxing options for running the pkcsslotd via systemd.
Many of these options are not really needed, because pkcsslotd run under
a non-privileged user (user pkcsslotd) so it can't perform any privileged
actions anyway.
With these settings, 'systemd-analyze security pkcsslotd.service' reports
an exposure level of 1.7 (score range 0.0 - 10.0).
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Create the unix sockets and the PID file in /run/opencryptoki, and make
sure the /run/opencryptoki directory as well as the lock and log directories
are created during 'make install' as well as during system startup via
tmpfiles.d. Since the /run directory usually is within a tmpfs file system,
it won't exist after a system restart otherwise.
Also make the /run/opencryptoki directory be owned by the 'pkcsslotd' user
and the 'pkcs11' group, and only writable by the 'pkcsslotd' user.
That way, pkcsslotd can only be started by the 'pkcsslotd' user (or root).
Nevertheless, members of the 'pkcs11' group can still connect to the sockets,
and thus can still communicate with pkcsslotd.
The 'pkcsslotd' user is created (if not already existent) during 'make install'
and RPM installation, together with the 'pkcs11' group.
When the pkcsslotd is started as 'root', change its uid to 'pkcsslotd' to drop
privileges and capabilities. Any capabilities set on the executable file
are retained, regardless if started as root or as pkcsslotd user.
If started as root, pkcsslotd can create any missing base directories, otherwise
an error is reported. It is expected that the base directories have been created
during package installation and/or tmpfiles.d prior to starting pkcsslotd.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Don't prefix with destination directory, as this would produce an invalid directory.
This would for example cause rpmbuild to fail.
Autoconf prefixes it with the destination directory automatically.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
The opencryptoki pkgconfig file opencryptoki.pc.in is similar to the other
files currently residing in the misc directory, such as the systemd service
unit file pkcsslotd.service.in, the init.d script pkcsslotd.in, and the
tmpfiles.d config file tmpfiles.conf.in. So lets move it there.
opencryptoki.pc is built from opencryptoki.pc.in via AC_CONFIG_FILES
in configure.ac, so no need to include it into DISTCLEANFILES explicitly,
it will be cleaned with 'make distclean' automatically.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Install opencryptoki.conf (which is built from misc/tmpfiles.conf.in)
right into /usr/lib/tmpfiles.d/.
Currently, misc/tmpfiles.conf is built from misc/tmpfiles.conf.in and is
then installed into /lib/systemd/system/ together with the systemd-service
unit file. Afterwards Makefile.am installs misc/tmpfiles.conf as
opencryptoki.conf into /usr/lib/tmpfiles.d/ and attempts to remove the
unnecessary copy from /lib/systemd/system/.
This is error prone, since there could have already been a file called
tmpfiles.conf (owned by another package) in /lib/systemd/system/ which
was now overwritten.
Use tmpfiles_DATA and tmpfilesdir in misc.mk instead to install it into
the right place right away, without possibly tampering any existing
files in /lib/systemd/system/.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
During install the tmpfiles.conf is copied together with pkcsslotd.service into
the usr/lib/systemd/system/. But we already have tmpfiles.conf as
opencryptoki.conf in the correct folder usr/lib/tmpfiles.d/. So we can remove
it.
Also fixed some documents name in spec file.
Signed-off-by: Eduardo Barretto <ebarretto@linux.vnet.ibm.com>
The old (previous version 3) pkcs11_startup configuration script was still being
called and mentioned in some of the code. Removed it to fix.
There is still mentioning of pkcs11_startup in some documents, those should be
maintained.
Signed-off-by: Eduardo Barretto <ebarretto@linux.vnet.ibm.com>
Update pkcsslotd.service.in to use After=local-fs.target instead of syslog.target. The syslog target doesn't exist any more.
Signed-off-by: Mark Post <mpost@suse.com>
Add support to create configuration file for creation, deletion and cleaning
of volatile and temporary files in systemd.
The tmpfiles.d/opencryptoki.conf file will be created automatically during
compilation time based on enabled tokens in configure. The output will be
installed in default systemd-tmpfiles path structure, described here [1].
[1] https://www.freedesktop.org/software/systemd/man/tmpfiles.d.html
This patch fixes#25
Signed-off-by: Paulo Vital <pvital@linux.vnet.ibm.com>
Slightly adapted version of Ingo's patch:
Patch hunks needed relocation because of previous commits
in some files. Removed some trailing whitespaces.
Tested, works.
Signed-off-by: Ingo Franzki <ifranzki@de.ibm.com>
Signed-off-by: Harald Freudenberger <freude@linux.vnet.ibm.com>
opencryptoki. Useful commands are prefixed with "ock_" to make easier
to callup. Internal functions are prefixed with "__ock_".
i.e. ock_dump_obj_template <OBJECT *>
- dumps and object's template
Signed-off-by: Kent Yoder <key@linux.vnet.ibm.com>
The TERM signal is sent by default when the killproc function is called.
Also the pid file created by the pkcsslotd executable is removed by the
initscript (resp. by the killproc function) only when no signal is set.
Other solution how to remove the pid file is to remove it directly by the
executable.
Signed-off-by: Dan Horák <dan@danny.cz>
pkcsslotd executable creates a pidfile as /var/lib/opencryptoki/.slotpid
(CONFIG_PATH + "/.slotpid"), but the corresponding initscipt expects the
pidfile at /var/run/pkcsslotd.pid and this one is used to check whether
the service is running etc. The attached patch switches pkcsslotd to using
the /var/run/pkcsslotd.pid one and also simplifies the logic in the initscript
because the daemon function takes care of the checked cases.
Signed-off-by: Dan Horák <dan@danny.cz>
force-reload action is added to the pkcsslotd initscript and also
it's documented in usage message together with reload action
Signed-off-by: Dan Horák <dan@danny.cz>
* master:
Fixed the pkcsslotd init script to make it return codes according to LSB specification.
Version update.
Fix wrong log message for "API already initialized" condition
Check for vendor-defined object classes
Fix public exponent attribute endianness bug
AES support included into the CCA token.
Makes pkcscca_migrate tool link dynamically to libcsulcca.so by using dlopen() instead.
Conflicts:
configure.in - took version number from master ("2.3.1")
Signed-off-by: Klaus Heinrich Kiwi <klausk@linux.vnet.ibm.com>
Unfortunately I couldn't split this patch in a sane way, because
essentially we're rewriting configure.in here.
In summary, the main changes are:
* Use AC_ARG_ENABLE() only to enable/disable building certain parts
of the code
* Use AC_ARG_WITH() only to specify libraries that may be needed by
certain portions of the code
* All AC_ARG_ENABLE() macros comes with architecture-independent
defaults. This means that we won't be trying to guess what
features (tokens) we should or should not be building.
* All AC_ARG_WITH() macros have 'check' as the default (check for
that library in the default search path)
* IMPORTANT: Separate pkcscca_migrate from cca token build, as only
the former requires the CCA libraries to link.
* No more dependencies of what stdll can be built based on arch.
Theoretically all stdll can be built on all archs, given that
it has the relevant libraries also (we know this is not always
true, so sometimes the user needs to explicitly disable a token
with --without-FEATURE to build on certain archs)
* The (special case of) ica stdll: builds ica_s390_stdll on s390
archs while using ica_stdll on any other arch.
Signed-off-by: Klaus Heinrich Kiwi <klausk@linux.vnet.ibm.com>
This patch moves the processing of misc/pkcsslotd.in to use
a sed script at build time instead of relying on configure
to process it at configure time. This allows us to be more
flexible when building to non-standard directories or other
odd scenarios. Also fixed to use standard directory variables.
Signed-off-by: Klaus Heinrich Kiwi <klausk@linux.vnet.ibm.com>
This is certainly more of a cosmetic change than anything
else, moving the install script that includes our library
directories in ld.so.conf from misc/Makefile.am to
usr/lib/Makefile.am, but it also brings some fixes such
as use -hook target instead of -local (make sure that
this is run *after* everything else on this dir) and
use standard pathnames variables.
Signed-off-by: Klaus Heinrich Kiwi <klausk@linux.vnet.ibm.com>
gets built and RPMs are created. Whereas before all possible tokens
were created by default, now only a default token is created implicitly. On
s390 systems, the default is the ica_390 token. On other platforms, the
default is the software token. Separate token RPMs may be created. A sample
spec file is provided for the a tpm token package. A package may also be
created containing just the libopencryptoki shared object. This will enable
a 32 bit libopencryptoki package to be created for 64 bit platforms in order
to maintain compatibility with previous releases.
structures padded due to alignment variations between x86_64 64bit
and 32 bit (i386) binaries.
Full path removed from pk_config_data file. Library paths added to
ld.so.conf.d files for library location.
