| Summary: | certutil -V ignores -f parameter | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Endi Sukma Dewata <edewata> |
| Component: | nss | Assignee: | nss-nspr-maint <nss-nspr-maint> |
| Status: | CLOSED WONTFIX | QA Contact: | BaseOS QE Security Team <qe-baseos-security> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | low | ||
| Version: | 7.3 | CC: | aakkiang, edewata, hkario, mgrepl |
| Target Milestone: | rc | Keywords: | Reopened |
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2019-02-11 15:39:40 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
|
Description
Endi Sukma Dewata
2016-11-16 04:23:59 UTC
Endi, could you please retest?
And if you retest, could you also please provide information where it's stuck prompting?
You could create a backtrace, that would help us, by doing the following:
- install the nss*/nspr debuginfo packages
- run your test
- once certutil is stuck prompting, attach using gdb
(use "ps" to find the process ID, then run
gdb certutil process-id )
- if attaching worked, use
bt
to create the stack where it's stuck, and please attach that stack to
this bug as a text file
thanks
The problem can still be reproduced with nss-3.33 on Fedora 26 (I don't have a RHEL HSM client at the moment).
Here is the backtrace:
(gdb) bt
#0 0x00007f4437e111b0 in __read_nocancel () at ../sysdeps/unix/syscall-template.S:84
#1 0x00007f4437d91198 in _IO_new_file_underflow (fp=0x20574f0) at fileops.c:600
#2 0x00007f4437d92442 in __GI__IO_default_uflow (fp=0x20574f0) at genops.c:413
#3 0x00007f4437d840c2 in __GI__IO_getline_info (eof=0x0, extract_delim=<optimized out>, delim=10, n=199, buf=0x7ffefaaa51c0 "",
fp=0x20574f0, fp@entry=0x0) at iogetline.c:60
#4 __GI__IO_getline (fp=fp@entry=0x20574f0, buf=buf@entry=0x7ffefaaa51c0 "", n=n@entry=199, delim=delim@entry=10,
extract_delim=extract_delim@entry=1) at iogetline.c:34
#5 0x00007f4437d82f9d in _IO_fgets (buf=buf@entry=0x7ffefaaa51c0 "", n=n@entry=200, fp=fp@entry=0x20574f0) at iofgets.c:53
#6 0x000000000041a720 in fgets (__stream=0x20574f0, __n=200, __s=0x7ffefaaa51c0 "") at /usr/include/bits/stdio2.h:263
#7 SEC_GetPassword (input=input@entry=0x20574f0, output=output@entry=0x2057720,
prompt=prompt@entry=0x7ffefaaa5310 "Enter Password or Pin for \"softcard\":", ok=0x41a800 <SEC_BlindCheckPassword>) at secpwd.c:79
#8 0x00000000004132c2 in SECU_GetPasswordString (arg=<optimized out>,
prompt=0x7ffefaaa5310 "Enter Password or Pin for \"softcard\":") at secutil.c:103
#9 0x0000000000413626 in SECU_GetModulePassword (slot=0x2048a50, retry=0, arg=<optimized out>) at secutil.c:236
#10 0x00007f4438775c5f in pk11_GetPassword (wincx=0x0, retry=<optimized out>, slot=0x2048a50) at pk11auth.c:532
#11 PK11_DoPassword (slot=0x2048a50, session=2253, loadCerts=<optimized out>, wincx=0x0, alreadyLocked=0, contextSpecific=0)
at pk11auth.c:602
#12 0x00007f44387768e0 in find_certs_from_nickname (nickname=0x20544b9 "ca_signing", nickname@entry=0x1fbedf0 "softcard:ca_signing",
wincx=wincx@entry=0x0) at pk11cert.c:783
#13 0x00007f443877780b in PK11_FindCertFromNickname (nickname=nickname@entry=0x1fbedf0 "softcard:ca_signing", wincx=wincx@entry=0x0)
at pk11cert.c:853
#14 0x00007f44387abc16 in common_FindCertByNicknameOrEmailAddrForUsage (name=name@entry=0x1fbedf0 "softcard:ca_signing",
anyUsage=anyUsage@entry=1, lookingForUsage=lookingForUsage@entry=certUsageSSLClient, wincx=wincx@entry=0x0, handle=0x204aae0)
at stanpcertdb.c:641
#15 0x00007f44387abde2 in CERT_FindCertByNicknameOrEmailAddrCX (handle=handle@entry=0x204aae0,
name=name@entry=0x1fbedf0 "softcard:ca_signing", wincx=wincx@entry=0x0) at stanpcertdb.c:687
#16 0x000000000041a070 in SECU_FindCertByNicknameOrFilename (handle=handle@entry=0x204aae0,
name=name@entry=0x1fbedf0 "softcard:ca_signing", ascii=0, pwarg=pwarg@entry=0x0) at secutil.c:3663
#17 0x000000000041069a in ValidateCert (pwdata=0x7ffefaaa56e0, ascii=<optimized out>, logit=0, checkSig=0, certUsage=<optimized out>,
date=0x0, name=<optimized out>, handle=0x204aae0) at certutil.c:712
#18 certutil_main (argc=<optimized out>, argv=<optimized out>, initialize=initialize@entry=1) at certutil.c:3240
#19 0x0000000000408d5b in main (argc=<optimized out>, argv=<optimized out>) at certutil.c:3680
This issue was not selected to be included either in Red Hat Enterprise Linux 7.7 because it is seen either as low or moderate impact to a small amount of use-cases. The next release will be in Maintenance Support 1 Phase, which means that qualified Critical and Important Security errata advisories (RHSAs) and Urgent Priority Bug Fix errata advisories (RHBAs) may be released as they become available. We will now close this issue, but if you believe that it qualifies for the Maintenance Support 1 Phase, please re-open; otherwise we recommend moving the request to Red Hat Enterprise Linux 8 if applicable. Removing needinfo flag. |