Allow runtime configuration of pkcs11 modules through config file

[Ondrej Kubik]

[Impact]

 * To be able to switch modules at runtime via configuration file change the default module from opensc-pkcs11 to p11-proxy module, which by default loads opensc-pkcs11 module unless configured by administrator to use something else.

 * This also allows configuration where multiple modules can be used together through the p11-proxy module.

 * This aligns Ubuntu closer with other distributions, and allows using the same builds of opensc in embedded configurations on Ubuntu Core with specialized modules

[Test Plan]

 * detailed instructions how to reproduce the bug

 * these should allow someone who is not familiar with the affected
   package to reproduce the bug and verify that the updated package fixes
   the problem.

 * if other testing is appropriate to perform before landing this update,
   this should also be described here.

[Where problems could occur]

 * Think about what the upload changes in the software. Imagine the change is
   wrong or breaks something else: how would this show up?

 * It is assumed that any SRU candidate patch is well-tested before
   upload and has a low overall risk of regression, but it's important
   to make the effort to think about what ''could'' happen in the
   event of a regression.

 * This must '''never''' be "None" or "Low", or entirely an argument as to why
   your upload is low risk.

 * This both shows the SRU team that the risks have been considered,
   and provides guidance to testers in regression-testing the SRU.

[Other Info]

 * Anything else you think is useful to include
 * Anticipate questions from users, SRU, +1 maintenance, security teams and the Technical Board
 * and address these questions in advance

[Ondrej Kubik (ondrak)]

Attached examples with changes to address this bug:

https://git.launchpad.net/~ondrak/ubuntu/+source/opensc/commit/?h=ubuntu/focal

https://git.launchpad.net/~ondrak/ubuntu/+source/libp11/commit/?h=ubuntu/focal

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Dimitri John Ledkov (xnox)]

libp11 in Ubuntu uses p11-kit-proxy.so by default already, so I don't believe it needs changing does it?

Focal:

https://launchpad.net/ubuntu/+source/libp11/0.4.10-1
https://launchpad.net/ubuntu/+source/libp11/0.4.10-1/+build/17239024
https://launchpadlibrarian.net/432332202/buildlog_ubuntu-eoan-amd64.libp11_0.4.10-1_BUILDING.txt.gz
Default PKCS11 module: /usr/lib/x86_64-linux-gnu/p11-kit-proxy.so

Jammy:
https://launchpad.net/ubuntu/+source/libp11/0.4.11-1build3
https://launchpad.net/~ci-train-ppa-service/+archive/ubuntu/4813-deletedppa/+build/23497085
https://launchpadlibrarian.net/592757435/buildlog_ubuntu-jammy-amd64.libp11_0.4.11-1build3_BUILDING.txt.gz
Default PKCS11 module: /usr/lib/x86_64-linux-gnu/p11-kit-proxy.so

[Dimitri John Ledkov (xnox)]

I see that in Fedora opensc provides a p11kit module to allow using opensc-pkcs11.so via p11-kit's proxy module https://src.fedoraproject.org/rpms/opensc/blob/rawhide/f/opensc.module

[Dimitri John Ledkov (xnox)]

In other distributions opensc by default is configured to use:

PKCS11 default provider: /usr/lib64/opensc-pkcs11.so
PKCS11 onepin provider: /usr/lib64/onepin-opensc-pkcs11.so

which we do on Ubuntu as well, but with multiarch paths.

However, I see that other distributions ship .module files to allow using opensc-pkcs11 via p11-kit proxy.

[Launchpad Janitor (janitor)]

[Expired for opensc (Ubuntu) because there has been no activity for 60 days.]