1395495 - modutil -create should initialize database with empty password

Status: RESOLVED FIXED

(NSS :: Tools, defect, P3)

Description

[Daiki Ueno [:ueno]]

Attachment: modutil-create-doc.patch

When an NSS database is created with "modutil -create", the initial password is set invalid and the database is unusable until the password is set with "modutil -changepw":

$ mkdir nssdb
$ modutil -dbdir sql:nssdb -create
$ certutil -S -s 'CN=ca' -n ca -x -t 'C,,' -d sql:nssdb
certutil: unable to generate key(s)
: SEC_ERROR_IO: An I/O error occurred during security authorization.

I would suggest to expand the doc to state that explicitly to avoid any confusion, like the attached patch.

Comment 1

[Kai Engert [:KaiE:]]

I think before we add this documentation, we should clarify if this is really the intended behavior, or, if this a bug and modutil should be changed to reject creation of such a database.

It seems this behavior is identical with both dbm: and sql: databases.

I think Bob should give us a recommendation for the intention.

Comment 2

[Kai Engert [:KaiE:]]

After we've discussed this in a meeting, we've reached an agreement to consider it a bug that modutil creates an uninitialized database, and that modutil should be changed in the following way:

if "modutil -create" is used, but no password parameter is given, then it should init NSS with a default (empty) password.

We may either close this bug and file a new one, or we could just change the purpose/subject of this bug.

Comment 3

[Emma Humphries ☕️🎸🧞‍♀️✨ (she/they) [:emceeaich] (Pacific Time) use needinfo]

Bulk change per wleung.

Comment 4

[Daiki Ueno [:ueno]]

(In reply to Kai Engert (:kaie:) from comment #2)

> We may either close this bug and file a new one, or we could just change the
> purpose/subject of this bug.

OK, let's reuse this bug.  I will attach a new patch.

Comment 5

[Daiki Ueno [:ueno]]

Attachment: modutil-create-empty.patch

Comment 6

[Kai Engert [:KaiE:]]

Comment on attachment 8908620 [details] [diff] [review]
modutil-create-empty.patch

Looks good, only a minor suggestion.

Instead of naming the test
  "Creating empty DB with modutil -create"
how about
  "Test if DB created by modutil -create is initialized"

(text is in two places)

r=kaie

Comment 7

[Kai Engert [:KaiE:]]

(In reply to Kai Engert (:kaie:) from comment #6)
>   "Test if DB created by modutil -create is initialized"

I assume you don't object to this name, I believe it's more descriptive.

I'll make that change for you and check it in.

Comment 8

[Kai Engert [:KaiE:]]

https://hg.mozilla.org/projects/nss/rev/279b257c6433

Comment 9

[Daiki Ueno [:ueno]]

Attachment: modutil-create-fix-test.patch

Sorry for the test failure; this patch should fix it.

Comment 10

[Kai Engert [:KaiE:]]

I notice that you use two different directory variables R_TOOLSDIR and TOOLSDIR, maybe it's better to be consistent? I assume that one is relative and the other is an absolute path, probably both will work.

Maybe you should also print an error message if the first step, the database creation, failed.

Comment 11

[Kai Engert [:KaiE:]]

Comment on attachment 8909313 [details] [diff] [review]
modutil-create-fix-test.patch

ok, let's try that, r=kaie

https://hg.mozilla.org/projects/nss/rev/70109a01ce53