340917 - crlutil should init NSS read-only for some options

Status: RESOLVED FIXED

(NSS :: Tools, defect, P2)

Description

[Julien Pierre]

Some options, such as list, only require read-only access. But crlutil always opens NSS read/write.
I think the list, generate, and modify CRL options only need read-only.
Alexei, can you confirm this about the last two options ? I believe the CRLs are output to DER files outside the NSS DBs, so write access is not required.

Comment 1

[Julien Pierre]

Attachment: only initialize NSS read-only for List, Generate and Modify commands

Looks like read-only only worked for the list option.

Comment 2

[Alexei Volkov]

The patch will work for list option, but generation/modification of crl will fail
if only modification from attachment 224961 [details] [diff] [review] are applied.

crlutil.c:SignAndStoreCrl also needs to be changed to look for a "slot" only in case when crl will be imported into a db.

Comment 3

[Alexei Volkov]

Comment on attachment 224961 [details] [diff] [review]
only initialize NSS read-only for List, Generate and Modify commands

will work for "list crl(s)" option only

Comment 4

[Julien Pierre]

Thanks for the review, Alexei.

I checked this in to the tip :

Checking in crlutil.c;
/cvsroot/mozilla/security/nss/cmd/crlutil/crlutil.c,v  <--  crlutil.c
new revision: 1.28; previous revision: 1.27
done