Do not let tmpfiles.d create the token specific directories inside
/var/lock/opencryptoki/. It is not known during build time which tokens
will exist later during run time. A user may configure any number of
tokens with any names in /etc/opencryptoki/opencryptoki.conf.
The API layer will create any non-existing token specific lock directories
inside /var/lock/opencryptoki/ during C_Initialize() as needed.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Allow to specify the pkcsslotd user and the pkcs11 group during
configuration.
Use '--with-pkcsslotd-user=USER' and/or '--with-pkcs-group=GROUP'
to specify the user and group name. The defaults are 'pkcsslotd'
and 'pkcs11'.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Create the unix sockets and the PID file in /run/opencryptoki, and make
sure the /run/opencryptoki directory as well as the lock and log directories
are created during 'make install' as well as during system startup via
tmpfiles.d. Since the /run directory usually is within a tmpfs file system,
it won't exist after a system restart otherwise.
Also make the /run/opencryptoki directory be owned by the 'pkcsslotd' user
and the 'pkcs11' group, and only writable by the 'pkcsslotd' user.
That way, pkcsslotd can only be started by the 'pkcsslotd' user (or root).
Nevertheless, members of the 'pkcs11' group can still connect to the sockets,
and thus can still communicate with pkcsslotd.
The 'pkcsslotd' user is created (if not already existent) during 'make install'
and RPM installation, together with the 'pkcs11' group.
When the pkcsslotd is started as 'root', change its uid to 'pkcsslotd' to drop
privileges and capabilities. Any capabilities set on the executable file
are retained, regardless if started as root or as pkcsslotd user.
If started as root, pkcsslotd can create any missing base directories, otherwise
an error is reported. It is expected that the base directories have been created
during package installation and/or tmpfiles.d prior to starting pkcsslotd.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Don't prefix with destination directory, as this would produce an invalid directory.
This would for example cause rpmbuild to fail.
Autoconf prefixes it with the destination directory automatically.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
The opencryptoki pkgconfig file opencryptoki.pc.in is similar to the other
files currently residing in the misc directory, such as the systemd service
unit file pkcsslotd.service.in, the init.d script pkcsslotd.in, and the
tmpfiles.d config file tmpfiles.conf.in. So lets move it there.
opencryptoki.pc is built from opencryptoki.pc.in via AC_CONFIG_FILES
in configure.ac, so no need to include it into DISTCLEANFILES explicitly,
it will be cleaned with 'make distclean' automatically.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Install opencryptoki.conf (which is built from misc/tmpfiles.conf.in)
right into /usr/lib/tmpfiles.d/.
Currently, misc/tmpfiles.conf is built from misc/tmpfiles.conf.in and is
then installed into /lib/systemd/system/ together with the systemd-service
unit file. Afterwards Makefile.am installs misc/tmpfiles.conf as
opencryptoki.conf into /usr/lib/tmpfiles.d/ and attempts to remove the
unnecessary copy from /lib/systemd/system/.
This is error prone, since there could have already been a file called
tmpfiles.conf (owned by another package) in /lib/systemd/system/ which
was now overwritten.
Use tmpfiles_DATA and tmpfilesdir in misc.mk instead to install it into
the right place right away, without possibly tampering any existing
files in /lib/systemd/system/.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
