66939 - PSM 1.x can not change profiles.

Status: VERIFIED FIXED

(Core :: Security: PSM, defect)

Description

[Javier Delgadillo]

ccarlen has been working on implementing changing user profiles for embedding.  
He came across a case using PSM on the Mac where the lack of SECMOD_Shutdown 
causes profile switching to not work.

Mac PSM is in process and uses the loadable root certificate technology for its 
list of trusted roots.  When ccarlen went to re-initialize NSS after shutting it 
down before, NSS couldn't initialize properly because the shared library was 
already loaded and some problems arose.  (He knows more about the specifics of 
that problem.)

I worked around this problem by calling SECMOD_DeleteModule to delete the 
loadable root certs module.  It'd be nice to get a SECMOD_Shutdown so that 
different profiles using external smart cards can work without having to quit and 
re-start.

This isn't crucial for NSS 3.2 since we've found a workaround, but would be nice 
to have in futures versions of NSS going forward.

Comment 1

[Conrad Carlen (not reading bugmail)]

Attachment: patch to psmglue for profile switching

Comment 2

[Conrad Carlen (not reading bugmail)]

Attachment: patch to psmserver for profile switching

Comment 3

[Conrad Carlen (not reading bugmail)]

Two patches here:
(1) for psmglue which registers it as a profile change observer
(2) for psm server to allow it to be exited and restarted.

After applying both patches, it's close but not quite. Here's how to see the
problem using the secure site: https://www.verisign.com/.
(1) Using PPEmbed, have at least two different profiles.
(2) Delete the "Security" folder from each profile dir so to start fresh.
PPEmbed's profiles are located at <Hard Disk>Documents:PPEmbed:Profiles:
(3) Go to the above URL. It will work and the "Security" dir will be created
within the profile dir with these 3 files: Certificates7, Key Database3, and
Security Modules.
(4) Change to the other profile and try and visit the same site. It won't work
and the "Security" dir will be created in the other profile dir but with only
these files: Certificates7 and Key Database3.

If I visit the above URL with one profile, quit, visit it with the other
profile, it will work fine and I can then always switch between profiles without
restart. Basically, all 3 files must be in the "Security" dir to begin with or
it won't work.

Comment 4

[Javier Delgadillo]

ccarlen:  This is a bug for NSS, not PSM.  Create a PSM bug and attach the 
patches to that bug.

Comment 5

[Javier Delgadillo]

Since this has PSM patches attached, I'm making this a PSM bug.  Will open a new 
bug for NSS issues.

Comment 6

[Javier Delgadillo]

Product->PSM

Comment 7

[Javier Delgadillo]

For NSS issues see Bug 67068

Comment 8

[Javier Delgadillo]

Turns out the problem is due to the fact that the SECMOD_ library in NSS can 
only be initialized once per process.  pk11util.c has a global variable that is 
checked in SECMO_init, and if it's non-NULL, the rest of the initialization is 
short-circuited.  That's why the "Security Modules" file doesn't get created for 
the second profile.  It's actually still using the "Security Modules" database 
from the first profile.

The loadable root certificates module loads up fine, so SSL does work.  If you 
were using smart cards on the system, then maybe this would be an issue, but I 
believe this should be OK for now.

Comment 9

[Javier Delgadillo]

ccarlen:  There is not enough time to spin a new NSS with the right fix.  In
essence, your users can only ever open one Security Modules database on the Mac.
 This doesn't affect functionality and would only be an issue if you were using
smart cards on your system.

I'm inclined to check-in the patches attached and mark the NSS bug 67068 as
FUTURE since this doesn't actually break SSL and really is a feature enhancement
request from NSS.

Comment 10

[Conrad Carlen (not reading bugmail)]

OK - That should be fine. Should we be alright with this on Win & Linux where
the mods to psmglue cause the psm app to exit? 

Comment 11

[Javier Delgadillo]

On non Mac platforms the new databases will be created.

(This assumes your test cases have succeeded on Win32 and Unix platforms.)

Comment 12

[Javier Delgadillo]

r=javi on these changes.

Comment 13

[Scott MacGregor]

sr=mscott

Comment 14

[Javier Delgadillo]

Patch checked in.

Comment 15

[Conrad Carlen (not reading bugmail)]

Great Thanks!

Comment 16

[John Unruh]

Verified per javier's comments.