Bug 695018

Summary: PEM module's segfaults on debug builds when logging file was created by root
Product: Red Hat Enterprise Linux 6 Reporter: Elio Maldonado Batiz <emaldona>
Component: nssAssignee: Elio Maldonado Batiz <emaldona>
Status: CLOSED ERRATA QA Contact: BaseOS QE Security Team <qe-baseos-security>
Severity: medium Docs Contact:
Priority: medium    
Version: 6.1CC: amarecek, emaldona, kdudka, kengert, rcritten, rrelyea, syeghiay
Target Milestone: rc   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: nss-3.12.10-3.el6 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: 695011 Environment:
Last Closed: 2011-12-06 12:10:33 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 695011    
Bug Blocks:    

Description Elio Maldonado Batiz 2011-04-09 19:36:15 UTC 
+++ This bug was initially created as a clone of Bug #695011 +++

Description of problem: While running debug builds the pem module sometimes crashes while attempting to write to its log file. The problem occurs when the module is used initially by an application being run as root and later by the same or another application running as a regular user.

Version-Release number of selected component (if applicable): nss-3.12.9-14.

How reproducible: often

Steps to Reproduce:
1. Use an application such as crypto-util's genkey untility to generate a self-signed certificate for an apache server or a CA. Such an operation must be run as root.
2. Run a application, e.g. curl, that will gets its cryptographic services by the pem module.

Actual results: The pem module crashes on initialization.

Expected results: The application should complete it's task normally

Additional info:

--- Additional comment from emaldona on 2011-04-09 14:27:42 EDT ---

The PEM module's initialization function pem_Initialize we has
....
    open_log(); 
    plog("pem_Initialize\n");
....
Looing is implemented in util.c with
FILE *plogfile;
void open_log()
{
#ifdef DEBUG
    plogfile = fopen("/tmp/pkcs11.log", "a");
#endif

    return;
}
The fopen tries to open the log file to write to it. If the log file was initilially created by an application running as root fopen will fail and plogfile will be set to NULL. Later plog calls
    vfprintf(plogfile, fmt, ap);
with a NULL and a crash happens.

Using the logging utilities from NSPR will prevent this problems. It is also what's required of modules intended to be part of NSS as this one is.

--- Additional comment from emaldona on 2011-04-09 15:30:36 EDT ---

Created attachment 490990 [details]
Reimplement PEM logging in terms of NSPR's own
Comment 2 Elio Maldonado Batiz 2011-04-09 19:43:48 UTC 
Normal users using standard builds will not run into this problem because
logging is compiled out. On the other hand, developers or users to whom we may
provide an NSS debug build to aid us with a bug investigation could run into
this.
Comment 3 RHEL Program Management 2011-04-10 06:00:11 UTC 
Since RHEL 6.1 External Beta has begun, and this bug remains
unresolved, it has been rejected as it is not proposed as
exception or blocker.

Red Hat invites you to ask your support representative to
propose this request, if appropriate and relevant, in the
next release of Red Hat Enterprise Linux.
Comment 10 errata-xmlrpc 2011-12-06 12:10:33 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHBA-2011-1584.html