1285338 - Unable to load new PKCS#11 module (Firefox 47.0.1)

Status: RESOLVED WORKSFORME

(Core :: Security: PSM, defect, P3)

Description

[drisacher]

User Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:47.0) Gecko/20100101 Firefox/47.0
Build ID: 20160623154057

Steps to reproduce:

Attempted to load PKCS#11 module in Firefox 47.0.2 on Windows 8.   Selected about:preferences->advanced->certificates->security-devices->load; navigated to .dll of security module.  Tried this with p11-capi, cackey, and coolkey modules.  


Actual results:

Small dialog pops up immediately with title "Alert" and message "Unable to add module".


Expected results:

Security module should be loaded.

Comment 1

[drisacher]

Works on same computer, same PKCS#11 modules, with Firefox 45.2.0.

Comment 2

[drisacher]

Could not duplicate my own issue with a different computer.  

The issue is repeatable with Firefox Portable on a enterprise-managed laptop - but could not duplicate with stock Firefox on personal, consumer-grade-Win8 computer.  It was working previously on the enterprise laptop, so I suspect the issue is something else on the laptop is preventing the DLL from loading or preventing the update of secmod.db.  

I'm still investigating, but this is probably not a Firefox bug.

Comment 3

[drisacher]

See also Bug #1231394

Comment 4

[drisacher]

Further discovery shows that the module will load under the same setup if the path is relative.  I.e. loading "p11-capi-32bit.dll" works if that file is placed in the same directory as Firefox.exe.  (Whereas loading c:\User\foo\bar\p11-capi-32bit.dll" did not.)  This causes me to suspect that AppLocker, SafeDllSearchMode or something similar is preventing the module from loading.  (q.v. https://blogs.technet.microsoft.com/srd/2014/05/13/load-library-safely/) That said, I cannot see an AppLocker rule that should be preventing this, and SafeDllSearchMode shouldn't be an issue if I'm reading the documentation correctly.

Comment 5

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

Is this still an issue?

Comment 6

[BugBot [:suhaib / :marco/ :calixte]]

Redirect a needinfo that is pending on an inactive user to the triage owner.
:keeler, since the bug has recent activity, could you please find another way to get the information or close the bug as INCOMPLETE if it is not actionable?

For more information, please visit auto_nag documentation.

Comment 7

[drisacher]

I am unable to duplicate this bug with current builds. Closing