Description of problem: Upon installation of the opencryptoki packages, pkcs11 group is created and root user is added to the group: http://pkgs.fedoraproject.org/gitweb/?p=opencryptoki.git;a=blob;f=opencryptoki.spec;h=ba9557de#l190 The purpose of this group is to restrict access to pkcsslotd's shared memory (which is root:pkcs11, 660). root user should not need access to the group to be able to access the shared memory. However, if root is removed from pkcs11, root can no longer use opencryptoki. This is due to a bogus check in the attach_shared_memory(), that requires explicit group membership regardless of the current effective privileges: http://opencryptoki.git.sourceforge.net/git/gitweb.cgi?p=opencryptoki/opencryptoki;a=blob;f=usr/lib/pkcs11/api/shrd_mem.c.in;h=42022c72#l354 Note that elsewhere in the code, similar check is only done when both uid and euid != 0: http://opencryptoki.git.sourceforge.net/git/gitweb.cgi?p=opencryptoki/opencryptoki;a=blob;f=usr/lib/pkcs11/common/new_host.c;hb=7f52b1ac#l543 It's unclear to me what the benefit of the check should be, as shared memory permissions are still checked. Steps to Reproduce: It can be demonstrated that root does not need to be in the pkcs11. Start root shell with privileges that do not include pkcs11 group. Ensure that root belongs to the group in the /etc/group. // check what we do not currently have pkcs11 group # id uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 // but it is in the /etc/group # id root uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel),498(pkcs11) // root can use opencryptoki # pkcsconf -t Token #1 Info: Label: IBM OS PKCS#11 Manufacturer: IBM Corp. Model: IBM SoftTok ... // remove root from the group # vigr # id root uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel) // root can no longer use opencryptoki, even though effective permissions // have not changed # pkcsconf -t Error initializing the PKCS11 library: 0x2 (CKR_HOST_MEMORY) CCing Steve, as he's recently been after killing root supplementary groups, which can be a problem for programs what do not drop group privileges correctly.
Created attachment 518278 [details] Patch attempting to fix the bug This probably fixes the bug.
+ relevant spec file change. Does it make sense to leave similar code in new_host.c mentioned in comment #0?
Those start off like this: if ( userid != 0 && euserid != 0 ) { // Root or effective Root is ok So, I think they are OK. Also note that bug 724007 is asking for supplemental groups to be dropped.