105209 - NSS_Init functions won't return error even if the Cert database files are not readable

Status: RESOLVED WORKSFORME

(NSS :: Libraries, defect, P2)

Description

[Kirankumar Arnepalli]

NSS_Initialize() and NSS_Init() function won't return error when the Cert db
files are not readable. Even if the Cert db file is not present, these functions
won't return error, but they always return SECSuccess.
This bug could be related to bug#105188, but i am not whether both of them
are same.

Comment 1

[Wan-Teh Chang]

Assigned the bug to Bob.

Are you using the tip of NSS?  Only NSS developers should
use the tip of NSS.  NSS users should use a certified
release, such as NSS_3_3_1_RTM.

Comment 2

[Kirankumar Arnepalli]

We're using NSS_3_3_RTM.

Comment 3

[Robert Relyea]

OK, what parameters are you using for NSS_Initialize()? Also, is your directory
read/write? (It's a mystery because I'm pretty sure we tested this in 3.3. I
know the code is supposed to error out on failures).

bob

Comment 4

[Kirankumar Arnepalli]

we're calling some thins like this.
NSS_Initialize(secmodpath, dbprefix, dbprefix, "secmod.db", NSS_INIT_RE
ADONLY);
The directory is read/write. But i have removed read/write permissions for
the cert7.db file in that directory. In this case it would give a SECSuccess.

Comment 5

[Robert Relyea]

Oh, the files exist, they just aren't readable. That one I'm pretty sure we
haven't tested. Moving to NEW.

bob

Comment 6

[Kirankumar Arnepalli]

Any idea what is the difference between the following two calls?
when i look at nss.h it does not say about 0 as being passed as flags parameter.

NSS_Initialize(secmodpath, dbprefix, dbprefix, "secmod.db", NSS_INIT_RE
ADONLY);

NSS_Initialize(secmodpath, dbprefix, dbprefix, "secmod.db", 0);

Comment 7

[Robert Relyea]

NSS_Initialize takes 4 flags:

READONLY - databases are open readonly
NOCERTDB - don't open the cert and key databases, just open the temparary database
NOMODDB - don't read secmod.db, just initialize the internal module.
FORCEOPEN - if you fail to open the cert and key databases, fallback to the
NOCERTDB or NOMODDB modes and keep going.

0 means none of these flags are set (databases are openned rw, cert key and
modutil databases are openned and read, if the databases cannot be openned or
created, fail).

NOTE: if you open databases r/w and the databases do not exist, NSS will create them

Comment 8

[Wan-Teh Chang]

Target 4.0, priority P2.

Comment 9

[Wan-Teh Chang]

Changed the QA contact to Bishakha.

Comment 10

[Julien Pierre]

I tested this against the trunk, setting the permissions to 0 with chmod on cert8.db . I ran certutil -L with initializes NSS read-only. I got an error as expected. Same if the files are missing. Marking WORKSFORME.