1956145 - SecurityDevices settings in policies.json don't take effect on Firefox

Status: RESOLVED WORKSFORME

(Firefox :: Enterprise Policies, defect)

Description

[Nicholas Clark]

OS: RHEL 9
Package: firefox-128.8.0-1.el9_5.x86_64

Steps to reproduce:

Created policies.json file:
{
"policies": {
"SecurityDevices": {
"Add": {
"OpenSC PKCS#11 Module": "/usr/lib64/opensc-pkcs11.so"
}
}
}

Actual results:

Security device is not defined.

Expected results:

I wanted to globally set a security device for PIV-II card use and it's not getting set.

Comment 1

[Nicholas Clark]

This is pretty much identical to Bug ID 1580753, but for firefox.

Comment 2

[Mike Kaply [:mkaply]]

Are there any errors when you go to about:policies or on the Javascript console?

Comment 3

[Nicholas Clark]

(In reply to Mike Kaply [:mkaply] from comment #2)

Are there any errors when you go to about:policies or on the Javascript console?

There is an error with the setting:
Unable to add security device OpenSC PKCS#11 Module.

Comment 4

[Mike Kaply [:mkaply]]

If you go to about:config, add a new string called:

browser.policies.loglevel

and set the value to

debug

It should put out the actual error.

Comment 5

[Nicholas Clark]

(In reply to Mike Kaply [:mkaply] from comment #4)

If you go to about:config, add a new string called:

browser.policies.loglevel

and set the value to

debug

It should put out the actual error.

It did print out the actual error:

[Exception... "Component returned failure code: 0x80004005 (NS_ERROR_FAILURE) [nsIPKCS11ModuleDB.addModule]" nsresult: "0x80004005 (NS_ERROR_FAILURE)" location: "JS frame :: resource:///modules/policies/Policies.sys.mjs :: onProfileAfterChange :: line 2374" data: no]

Browser Console has this:

NS_ERROR_FAILURE: Component returned failure code: 0x80004005 (NS_ERROR_FAILURE) [nsIPKCS11ModuleDB.addModule]
    onProfileAfterChange resource:///modules/policies/Policies.sys.mjs:2374
    _runPoliciesCallbacks resource://gre/modules/EnterprisePoliciesParent.sys.mjs:247
    BG_observe resource://gre/modules/EnterprisePoliciesParent.sys.mjs:293

Comment 6

[Mike Kaply [:mkaply]]

And just to verify, when you add the module manually, it works?

Comment 7

[Nicholas Clark]

Ah, you know what, it isn't working manually either.

It's been a few years since I last tried and it looks like loading this library does not work anymore. I am unsure if it is some other setting that broke this functionality. It used to be this path back when cck2 was still a thing.

Comment 8

[Nicholas Clark]

I figured it out. There was another module that seems to be built-in, loaded by default, called p11-kit-proxy. Unloading p11-kit-proxy and then I was able to load the opensc module.

Comment 9

[Mike Kaply [:mkaply]]

Awesome. Glad you figured it out.

Comment 10

[Nicholas Clark]

Looks like this was a change back in RHEL8 per https://www.redhat.com/en/blog/consistent-pkcs-11-support-red-hat-enterprise-linux-8, that the p11-kit-proxy should be used as it will support use of system's configured module (which can be opensc).

This can be closed. Thanks.