| Summary: | certutil asks for PIN even though "-f ..." is specified for trust modification (-M) operations | ||||||
|---|---|---|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Stanislav Zidek <szidek> | ||||
| Component: | nss | Assignee: | Kai Engert (:kaie) (inactive account) <kengert> | ||||
| Status: | CLOSED ERRATA | QA Contact: | Stanislav Zidek <szidek> | ||||
| Severity: | medium | Docs Contact: | |||||
| Priority: | medium | ||||||
| Version: | 7.3 | CC: | dueno, hkario, kengert, nmavrogi, rrelyea, szidek | ||||
| Target Milestone: | rc | ||||||
| Target Release: | --- | ||||||
| Hardware: | All | ||||||
| OS: | Linux | ||||||
| Whiteboard: | |||||||
| Fixed In Version: | nss-3.34.0-0.1.beta1.el7 | Doc Type: | If docs needed, set a value | ||||
| Doc Text: | Story Points: | --- | |||||
| Clone Of: | |||||||
| : | 1524672 (view as bug list) | Environment: | |||||
| Last Closed: | 2018-04-10 09:23:57 UTC | Type: | Bug | ||||
| Regression: | --- | Mount Type: | --- | ||||
| Documentation: | --- | CRM: | |||||
| Verified Versions: | Category: | --- | |||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||
| Bug Depends On: | |||||||
| Bug Blocks: | 1524672 | ||||||
| Attachments: |
|
||||||
|
Description
Stanislav Zidek
2016-09-13 10:58:59 UTC
#8 0x0000000000413122 in SECU_GetPasswordString (arg=<optimized out>, prompt=0x7fffffffde30 "Enter Password or Pin for \"softhsm\":") at secutil.c:99 #9 0x000000000041351c in SECU_GetModulePassword (slot=0x68b630, retry=0, arg=<optimized out>) at secutil.c:232 #10 0x00007ffff766fc9d in pk11_GetPassword (wincx=0x0, retry=0, slot=0x68b630) at pk11auth.c:545 #11 PK11_DoPassword (slot=0x68b630, session=1, loadCerts=<optimized out>, wincx=0x0, alreadyLocked=0, contextSpecific=0) at pk11auth.c:615 #12 0x00007ffff7670fba in PK11_FindCertFromNickname (nickname=0x695f78 "Example CA", nickname@entry=0x62d6c0 "softhsm:Example CA", wincx=wincx@entry=0x0) at pk11cert.c:555 #13 0x00007ffff76a4891 in common_FindCertByNicknameOrEmailAddrForUsage (name=name@entry=0x62d6c0 "softhsm:Example CA", anyUsage=anyUsage@entry=1, lookingForUsage=lookingForUsage@entry=certUsageSSLClient, handle=0x68d4a0) at stanpcertdb.c:622 #14 0x00007ffff76a48ef in CERT_FindCertByNicknameOrEmailAddr (handle=handle@entry=0x68d4a0, name=name@entry=0x62d6c0 "softhsm:Example CA") at stanpcertdb.c:661 #15 0x0000000000410776 in ChangeTrustAttributes (pwdata=0x7fffffffe1d0, trusts=0x7fffffffe6c9 "C,,", name=0x62d6c0 "softhsm:Example CA", slot=0x68b630, handle=0x68d4a0) at certutil.c:368 #16 certutil_main (argc=<optimized out>, argv=<optimized out>, initialize=initialize@entry=1) at certutil.c:3229 #17 0x000000000040932b in main (argc=<optimized out>, argv=<optimized out>) at certutil.c:3703 We have too many scenarios where the password information isn't passed down to functions, because APIs don't support it. In this case, our code calls CERT_FindCertByNicknameOrEmailAddr, which doesn't support passing along password information, but that token is "unfriendly" (requires authentication to list certificates), and so we're stuck. Created attachment 1261391 [details]
idea v1
Bob, do you think this could work realiably?
If not, should we introduce another variation of API CERT_FindCertByNicknameOrEmailAddr which takes wincx as an additional parameter?
(In reply to Stanislav Zidek from comment #9) > Isn't this related to bz1395301 btw? Similar symptom, but completely different code path, and a different fix required. Yes, I think that's a reasonable work around. Long term we should create a version that takes a cx. NOTE: as coded, there is a potential reference leak. You'll need to free any cert returned from CERT_FindCertByNickname(). bob I've submitted a suggested fix upstream, as it's little work, and as it might help for bug 1088366. I've attached an additional patch for the delete scenario to https://bugzilla.mozilla.org/show_bug.cgi?id=1424282 Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHEA-2018:0679 |