The following are the system resources used by openCryptoki Please also see https://www.ibm.com/docs/en/linux-on-systems?topic=features-architecture-components-opencryptoki The user under which pkcsslotd runs (default: pkcsslotd) and the group that all openCryptoki applications must belong to (default: pkcs11) can be configured at build time using: ./configure --with-pkcsslotd-user=USER --with-pkcs-group=GROUP Throughout this document PKCSSLOTD_USER refers to that configured user and PKCS_GROUP refers to that configured group. Each token can additionally have its own user group, configured per slot in opencryptoki.conf with the keyword: usergroup = GROUP If usergroup is not set for a slot, TOKEN_GROUP defaults to PKCS_GROUP. Throughout this document TOKEN_GROUP refers to that per-token group. All members of TOKEN_GROUP must also be members of PKCS_GROUP. PKCSSLOTD_USER must also be a member of PKCS_GROUP. 1. Shared memory = 1 per token + 1 segment between pkcsslotd & api + 1 statistic segment per user (if statistics are enabled) a. Between pkcsslotd and api The pkcsslotd daemon has its own shared memory segment that it creates and shares with the API library. Part of the data is passed through sockets but there is still some data shared via shared memory. Owner: PKCSSLOTD_USER Group: PKCS_GROUP Mode: 0660 (rw-rw----) Size: sizeof(Slot_Mgr_Shr_t) - a fixed structure holding per-process and per-slot session counters for up to 1000 processes and 1024 slots. Approximately 12 MB on 64-bit platforms. b. Each token has its own shared memory segment. openCryptoki processes attach to the token segment and shared memory acts as a global state tracking mechanism. Owner: the first application process to open the token Group: TOKEN_GROUP Mode: 0660 (rw-rw----) Size: sizeof(LW_SHM_TYPE) - holds a TOKEN_DATA mirror plus two arrays of MAX_TOK_OBJS object index entries (default: 2048 public + 2048 private). Approximately 65 KB per token at the default setting. MAX_TOK_OBJS can be set at build time: ./configure --with-max-token-objects=N Example segment names visible under /dev/shm: var.lib.opencryptoki.ccatok var.lib.opencryptoki.swtok var.lib.opencryptoki.ep11tok var.lib.opencryptoki.tpm.root var.lib.opencryptoki.lite c. If collection of statistics is enabled, there is one shared memory segment per user. It is created at the first usage of openCryptoki of a user, and is named var.lib.opencryptoki_stats_ where is the numeric user id of the user. Owner: the user Group: the user's primary group Mode: 0600 (rw-------) Size: num_configured_slots × MECHTABLE_NUM_ELEMS × (NUM_SUPPORTED_STRENGTHS + 1) × sizeof(CK_ULONG) = num_slots × approximately 200 mechanisms × 5 strength buckets × 8 bytes = approximately 16 KB per configured slot. Use the pkcsstats tool to display the statistics, and remove statistics segments for users no longer needed. 2. Sockets - up to 3 a. Unix socket between pkcsslotd and API processes to transfer slot information. Path: /run/opencryptoki/pkcsslotd.socket Owner: PKCSSLOTD_USER Group: PKCS_GROUP Mode: 0660 (rw-rw----) b. Unix socket between pkcsslotd and event sources (e.g. pkcshsm_mk_change) to deliver events to tokens of running openCryptoki applications. Path: /run/opencryptoki/pkcsslotd.admin.socket Owner: PKCSSLOTD_USER Group: PKCS_GROUP Mode: 0660 (rw-rw----) c. Netlink socket owned by pkcsslotd to listen for udev events (s390 platform only). This is used to produce events on APQNs becoming online or offline. Note: pkcsslotd also uses an epoll file descriptor internally to multiplex all of the above, but it is not a socket and leaves no on-disk resource. 3. Files Note: on Linux the runtime directory is /run. On AIX it is /var/run. All paths below that start with /run/opencryptoki/ are therefore /var/run/opencryptoki/ on AIX. a. Directories The following directories are created by pkcsslotd at startup if they do not already exist. They are normally pre-created by tmpfiles.d. /run/opencryptoki/ Owner: PKCSSLOTD_USER Group: PKCS_GROUP Mode: 0710 (rwx--x---) /var/lock/opencryptoki/ Owner: PKCSSLOTD_USER Group: PKCS_GROUP Mode: 0770 (rwxrwx---) /var/log/opencryptoki/ Owner: PKCSSLOTD_USER Group: PKCS_GROUP Mode: 0770 (rwxrwx---) /var/lib/opencryptoki/ Owner: PKCSSLOTD_USER Group: PKCS_GROUP Mode: 0770 (rwxrwx---) /var/lib/opencryptoki/HSM_MK_CHANGE/ Owner: PKCSSLOTD_USER Group: PKCS_GROUP Mode: 0770 (rwxrwx---) Each token's data directory (e.g. /var/lib/opencryptoki/swtok/) and its TOK_OBJ/ subdirectory are created by pkcsslotd when a token is first seen, or by the 'pkcstok_admin create' command. When created by pkcsslotd (only possible when TOKEN_GROUP == PKCS_GROUP; if usergroup= is set to a different group, pkcsslotd refuses and requires 'pkcstok_admin create' to be used instead): Owner: PKCSSLOTD_USER Group: TOKEN_GROUP Mode: 0770 (rwxrwx---) When created by 'pkcstok_admin create' (must be run as root): Owner: root Group: TOKEN_GROUP Mode: 0770 (rwxrwx---) Use 'pkcstok_admin chown' to reassign group ownership after creation. The TPM token uses per-user subdirectories instead: /var/lib/opencryptoki/tpm/${USER}/ Owner: the user Group: the user's primary group Mode: 0700 b. Lock files All lock files are owned by whoever creates the file first. LCK..APIlock is created by pkcsslotd (owner: PKCSSLOTD_USER). LCK..HSM_MK_CHANGElock is created by pkcshsm_mk_change or the first application to acquire it (owner: that process's user). Per-token lock subdirectories and lock files are created by the application process and are thus owned by the application user. Mode: 0440 (r--r-----) Linux / 0220 (-w--w----) AIX # ls /var/lock/opencryptoki/ LCK..APIlock (Owner: PKCSSLOTD_USER Group: PKCS_GROUP) LCK..HSM_MK_CHANGElock (Owner: application user Group: PKCS_GROUP) ccatok/LCK..ccatok (Owner: application user Group: TOKEN_GROUP) ep11tok/LCK..ep11tok (Owner: application user Group: TOKEN_GROUP) icsf/LCK..icsf (Owner: application user Group: TOKEN_GROUP) lite/LCK..lite (Owner: application user Group: TOKEN_GROUP) swtok/LCK..swtok (Owner: application user Group: TOKEN_GROUP) tpm//LCK..tpm (Owner: application user Group: TOKEN_GROUP) c. Trace files Generated per process when OPENCRYPTOKI_TRACE_LEVEL is set. Path: /var/log/opencryptoki/trace. Owner: the process owner Group: PKCS_GROUP Mode: 0640 (rw-r-----) No size limit; one file per process while tracing is active. d. Config files (some are optional) # ls /etc/opencryptoki/ opencryptoki.conf root:root 0644 main slot configuration ep11tok.conf root:root 0644 EP11 token configuration (name set via confname= in opencryptoki.conf) ep11cpfilter.conf root:root 0644 EP11 CP-filter config (name set via CPFILTER in ep11tok.conf) ccatok.conf root:root 0644 CCA token configuration (name set via confname= in opencryptoki.conf) .conf root:root 0644 ICSF token configuration (created by pkcsicsf, name = ICSF token name) p11kmip.conf root:PKCS_GROUP 0640 p11kmip tool config p11sak_defined_attrs.conf root:PKCS_GROUP 0640 p11sak custom attributes policy.conf root:PKCS_GROUP 0640 key policy configuration strength.conf root:PKCS_GROUP 0640 key strength configuration e. PID file - created by pkcsslotd at startup Path: /run/opencryptoki/pkcsslotd.pid Owner: PKCSSLOTD_USER Group: PKCS_GROUP Mode: 0644 (rw-r--r--) Size: a few bytes (ASCII decimal PID followed by newline). Note: pkcsslotd drops root privileges via setuid/setgid + execv before any files are created, so all files it writes are owned by PKCSSLOTD_USER with primary group PKCS_GROUP. f. Token data files 3 files per token + 1 additional RACF file for the ICSF token + wrapped key files for the TPM token (per user). Owner: the application user performing the operation (C_InitToken, C_SetPIN, etc.) Group: TOKEN_GROUP Mode: 0660 (rw-rw----) (TPM token: owner = the user, no group sharing, mode 0600) NVTOK.DAT - Token metadata (label, flags, PIN hashes, version info). Size: sizeof(TOKEN_DATA), a fixed ~400-byte structure. MK_SO - Master key encrypted with the SO PIN. Not present on TPM token. MK_USER - Master key encrypted with the USER PIN. Not present on TPM token. RACF - ICSF token only: encrypted RACF password. /var/lib/opencryptoki/tpm/${USER}/PRIVATE_ROOT_KEY.pem /var/lib/opencryptoki/tpm/${USER}/PUBLIC_ROOT_KEY.pem - TPM token only: per-user software root key pair. g. Token object files One OBJ.IDX index file and one binary file per stored token object, all inside the token's TOK_OBJ/ directory. Both file types are written by the application process and share the same ownership model: the owner is the application user that performed the operation (who must be a member of TOKEN_GROUP). Group: TOKEN_GROUP Mode: 0660 (rw-rw----) (TPM token: mode 0600, no group access) OBJ.IDX - Text index listing the names of all current token objects, one per line. Appended to when objects are created, rewritten (via IDX.TMP) when objects are deleted. OBxxxxxx - Individual token object files. Each file stores one serialized PKCS#11 object in binary format (encrypted for private objects). The 8-character filename is generated by mkstemp() using the template "OBXXXXXX" and is never reused. The maximum number of token objects per token is MAX_TOK_OBJS (default: 2048 public + 2048 private). Configurable at build time: ./configure --with-max-token-objects=N h. HSM master key change state files /var/lib/opencryptoki/HSM_MK_CHANGE/ Directory created by pkcsslotd; used by pkcshsm_mk_change to persist MK change operation state across slots. State files within that directory are written by pkcshsm_mk_change: Owner: the user running pkcshsm_mk_change Group: PKCS_GROUP Mode: 0660 (rw-rw----)