p11-kit: Add a new 'isolate' pkcs11 config option

This sets 'remote' appropriately to run the module in a separate
process.

https://bugs.freedesktop.org/show_bug.cgi?id=80472

diff --git a/doc/manual/p11-kit-sharing.xml b/doc/manual/p11-kit-sharing.xml
index bf0ed01e86fd2c838257d2038d42629ef40add82..453d42b47fdfe673c6744ad75aabe3b560012ade 100644 (file)
--- a/doc/manual/p11-kit-sharing.xml
+++ b/doc/manual/p11-kit-sharing.xml
@@ -99,6 +99,10 @@
                        purposes. See the <link linkend="option-log-calls"><literal>log-calls = yes</literal></link>
                        module configuration option.</para>
                </listitem>
+               <listitem>
+                       <para>Managed modules have the ability to be isolated in their own process
+                       See the <link linkend="option-isolated"><literal>isolated = yes</literal></link>
+                       module configuration option.</para>
                </itemizedlist>
        </section>
 </chapter>

diff --git a/doc/manual/pkcs11.conf.xml b/doc/manual/pkcs11.conf.xml
index 26176778626daeff202c556ea0074b7e10ea585f..86c8fcbd4d024c25e96996996f3908d21033ceaa 100644 (file)
--- a/doc/manual/pkcs11.conf.xml
+++ b/doc/manual/pkcs11.conf.xml
@@ -131,6 +131,14 @@ x-custom : text
                        not present, then any process will load the module.</para>
                </listitem>
        </varlistentry>
+       <varlistentry id="option-isolated">
+               <term><option>isolated:</option></term>
+               <listitem>
+                       <para>Set to <literal>yes</literal> to run this PKCS#11 module in its own
+                       process. This is a simple way to set the <option>remote</option> to
+                       accomplish the same thing.</para>
+               </listitem>
+       </varlistentry>
        <varlistentry>
                <term><option>managed:</option></term>
                <listitem>

diff --git a/p11-kit/modules.c b/p11-kit/modules.c
index 7dbb6ed16f502f553c819ccc42149e74c745b0a5..bfcd3e5e9445d188c42fca73b2a7f64211cb0937 100644 (file)
--- a/p11-kit/modules.c
+++ b/p11-kit/modules.c
@@ -482,10 +482,12 @@ take_config_and_load_module_inlock (char **name,
                                     p11_dict **config,
                                     bool critical)
 {
-       const char *filename;
-       const char *remote;
+       const char *filename = NULL;
+       const char *remote = NULL;
+       char *value = NULL;
+       CK_RV rv = CKR_OK;
+       bool isolated;
        Module *mod;
-       CK_RV rv;
 
        assert (name);
        assert (*name);
@@ -493,24 +495,40 @@ take_config_and_load_module_inlock (char **name,
        assert (*config);
 
        if (!is_module_enabled_unlocked (*name, *config))
-               return CKR_OK;
+               goto out;
 
        remote = p11_dict_get (*config, "remote");
+       if (remote == NULL) {
+               filename = p11_dict_get (*config, "module");
+               if (filename == NULL) {
+                       p11_debug ("no module path for module, skipping: %s", *name);
+                       goto out;
+               }
+       }
+
+       /* The 'isolated' setting is just a simple way to configure remote */
+       isolated = _p11_conf_parse_boolean (p11_dict_get (*config, "isolated"), false);
+       if (isolated) {
+               if (remote) {
+                       p11_message ("ignoring 'isolated' on module '%s' because 'remote' is set", *name);
+                       isolated = false;
+               } else {
+                       if (asprintf (&value, "|" BINDIR "/p11-kit remote '%s'", filename) < 0)
+                               return_val_if_reached (CKR_DEVICE_ERROR);
+                       remote = value;
+               }
+       }
+
        if (remote != NULL) {
                rv = setup_module_for_remote_inlock (*name, remote, &mod);
                if (rv != CKR_OK)
-                       return rv;
+                       goto out;
 
        } else {
-               filename = p11_dict_get (*config, "module");
-               if (filename == NULL) {
-                       p11_debug ("no module path for module, skipping: %s", *name);
-                       return CKR_OK;
-               }
 
                rv = load_module_from_file_inlock (*name, filename, &mod);
                if (rv != CKR_OK)
-                       return CKR_OK;
+                       goto out;
 
                /*
                 * We support setting of CK_C_INITIALIZE_ARGS.pReserved from
@@ -529,7 +547,9 @@ take_config_and_load_module_inlock (char **name,
        *name = NULL;
        mod->critical = critical;
 
-       return CKR_OK;
+out:
+       free (value);
+       return rv;
 }
 
 static CK_RV