[UBUNTU 22.04] opencryptoki 3.17.0 is missing the strength.conf config file

[bugproxy]

SRU Justification:
==================

[Impact ]

 * Opencryptoki added policy support (after 3.17) with 3.18,
   which requires to have a strength.conf file in place.

 * Without the strength.conf file such newer opencryptoki version will not work.

 * And an error like this is shown, in case pkcsconf is going to be used:
   # pkcsconf -t
   Error initializing the PKCS11 library: 0x5 (CKR_GENERAL_ERROR)

[ Test Plan ]

 * A end to end scenario, that covers the following stack:

      Java program using crypto
                   |
                  JCA (with IBM Java 8)
                   |
             IBMPKCS11Impl
                   |
              OpenCryptoki
               / \
          ICA-token soft-token ...
               |
    s390x_clear-key_crypto-hw

   can be based on a Java application that does
   AES encryption in ECB mode with a randomly generated key (DRBG-SHA-512)
   and exploiting JCA / IBMPKCS11Impl
   with opencryptoki managing clear keys,
   either with a soft-token or an ICA token.

 * The pkcsconf tool is here used to manage (initialize and re-label)
   the tokens before used by the Java application.

 * For the detailed steps and the Java application itself,
   please see https://launchpadlibrarian.net/673367325/example.txt

[ Where problems could occur ]

 * The strength.conf file might have wrong content

 * or is at a wrong file-system location

 * or strength.conf might have wrong file permissions,
   which is checked inside of the tool's code.

 * In all these cases pkcsconf will still not work even if the file is in place.

[ Other Info ]

 * The strength.conf file allows users to configure openCryptoki
   cryptographic key strength determination based on key attributes.
   And this file is required by openCryptoki.
   The strength configuration file has to be owned by 'root:@pkcs_group',
   have mode 0640, and be parsable. Otherwise, openCryptoki will return
   'CKR_FUNCTION_FAILED' on 'C_Initialize' and log a corresponding message
   to syslog detailing the reason why the strength configuration could
   not be used. (more see 'strength.conf' in man5)

 * To simplify the packaging d/opencryptoki.install now installs the
   entire content of the etc/opencryptoki build folder,
   especially to catch all conf files.
   This eventually also makes the arch-specific file
   d/opencryptoki.install.s390x obsolete.

 * Package opencryptoki has reverse dependencies:
   $ reverse-depends -a source src:opencryptoki
   Reverse-Build-Depends
   * simple-tpm-pk11 (for libopencryptoki-dev)
   * tpm-tools (for libopencryptoki-dev)
   These were rebuild for test purposes, in addition to opencryptoki itself,
   and are available at PPA:
   https://launchpad.net/~fheimes/+archive/ubuntu/lp2018911
__________

---Problem Description---
Summary
=======
IBM z16 system LPAR
OS: "Ubuntu 22.04.1 LTS (Jammy Jellyfish)" on 5.15.0-69-generic kernel
    providing
    opencryptoki 3.17.0+dfsg+20220202.b40982e-0ubuntu1.1 s390x
The opencryptoki package is missing the strength.conf file

Details
=======
When attempting to build up no opencryptoki token is displayed.
Further investigations revealed the problem is related to a missing configuration file which is not shipped/included by the opencryptoki package.

Run : dpkg -L opencryptoki and check the list of files for the /etc directory.

Furhter, enabled the opencryptoki debug messages to display why the tokens are not built up by 'export OPENCRYPTOKI_TRACE_LEVEL=4', then running pkcsconf -t. A log file is written to the /var/log/opencryptoki directory. Mind to unset the trace var again.

Terminal output
===============
# cat /var/log/opencryptoki/trace.15928
04/27/2023 14:01:34 15928 [usr/lib/common/trace.c:210 api] INFO: **** OCK Trace level 4 activated for OCK version 3.17.0 ****
04/27/2023 14:01:34 15928 [usr/lib/api/api_interface.c:2875 api] INFO: C_Initialize
04/27/2023 14:01:34 15928 [usr/lib/api/policy.c:1666 api] ERROR: Failed to open /etc/opencryptoki/strength.conf: No such file or directory
04/27/2023 14:01:34 15928 [usr/lib/api/api_interface.c:3092 api] ERROR: Policy loading failed! rc=0x5
04/27/2023 14:01:34 15928 [usr/lib/api/api_interface.c:1656 api] INFO: C_Finalize
04/27/2023 14:01:34 15928 [usr/lib/api/api_interface.c:1658 api] ERROR: API not initialized

Contact Information = <email address hidden>

---uname output---
Linux sytem 5.15.0-69-generic #76-Ubuntu SMP Fri Mar 17 17:22:11 UTC 2023 s390x s390x s390x GNU/Linux

Machine Type = IBM Type: 3931 Model: 704 A01

---Debugger---
A debugger is not configured

---Steps to Reproduce---
 1.) Install Ubuntu 22.04.1 onto your LPAR, VM guest or KVM guest
2.) Install opencryptoki via apt-get install -y opencryptoki
3.) run: pkcsconf -t
    and watch the problem to occur
  # pkcsconf -t
  Error initializing the PKCS11 library: 0x5 (CKR_GENERAL_ERROR)
4.) export OPENCRYPTOKI_TRACE_LEVEL=4
5.) Run step 4 again
6.) ls -l /var/log/opencryptoki
    The debug file contains the hit to the missing .conf file

Userspace tool common name: pkcsconf

The userspace tool has the following bit modes: 64bit

Userspace rpm: opencryptoki

Userspace tool obtained from project website: na

*Additional Instructions for <email address hidden>:
-Attach ltrace and strace of userspace application.

== Comment: <email address hidden> - 2023-04-28 03:52:34 ==
That is somewhat strange. Opencryptoki 3.17 does NOT yet contain support for policies, at least not the upstream version. Policy support came only with 3.18.
So I would not have expected that 3.17 has policy support at all.

However, I don't know if the policy support was backported for/by Ubuntu to Ubuntu's opencryptoki 3.17?

If that's the case, then I would assume that only policy support, but not support for statistics was backported (you can check if 'pkcsstats' is available with Ubuntu's 3.17).

With just policy support (but not statistics), the 2 config files required for enabling policies (strength.cong and policy.conf) are intentionally not shipped and installed in /etc/opencryptoki, but it is the user's responsibility to provide both of them when enabling policies. Examples for both of these config files are provided in the documentation directory of the package: strength-example.conf and policy-example.conf.

With 3.18, statistics support was added, and with that, the strength.conf file was changed to be shipped and installed in /etc/opencryptoki, because the statistics support needs to know the strength definitions as well, independent of policies being enabled or not. So starting with 3.18, a user would only have to supply a policy.conf file to enable policies, if the provided strength configuration matches its need.

Please keep in mind, the provided strength.conf/strength-example.conf and policy-example.conf file are intentionally just examples! A user must adjust them to what its requirements on key strength and policy settings are. For example, the provided policy example config file 'policy-example.conf' contains the following:

  # Do not require any specific strength.
  # You probably do not want this!
  strength = 0

So this is something that the user must adjust in any case. Having a policy that requires a key strength of 0 bits simply means that all keys of all strength are allowed.

Please also see 'man policy.conf' and 'man strength.conf' for details.

Given above, I would tent to consider this BZ as 'works as designed', unless it turns out that the backport misses important things.

== Comment: <email address hidden> - 2023-04-28 03:59:08 ==
It only fails if the user has supplied a policy.conf file, but no strength.conf file.

== Comment: <email address hidden> - 2023-05-08 05:10:09 ==
Apparently the policy as well as statistics support shall be integrated into the opencryptoki library release shipped with Ubuntu 22.04 (jammy jellyfish). Please integrate a default strength.conf file.
Thanks.

Refer also to the comment in LaunchPad LP1959419 :
"Please note that with the patches on top of 3.17 a new strength.conf file is being installed into /etc/opencryptoki when doing 'make install'. Make sure that you include this new file into your package so that it gets installed at the user systems. Without the strength.conf file opencryptoki won't work."

== Comment: <email address hidden> - 2023-05-08 06:14:46 ==
Note that strength.conf must be owned by root:pkcs11 and MUST (!) have a mode of 0640.

[Frank Heimes (fheimes)]

The release-cycles of Ubuntu 22.04/jammy and opencryptoki weren't very well aligned (during jammy development), and it was decided to take a snapshot of opencryptoki 3.17 "+ commits up to b40982e" as of date 20220202 (which is encoded in the DEB package version as '3.17.0+dfsg+20220202.b40982e').
This can be a bit confusing (since I believe this package is closer to 3.18 than to 3.17) - and we usually avoid creating such snapshot packages, but in this case we wanted to have several new features incl. for 22.04/LTS.
I checked that the strength.conf is not part of the package (but the -example is).
But we can included it and thus ensure that the file permissions are 640.
I'm going to incl. everything that is generated under /etc/opencryptoki to the package and explicitly set strength.conf to 640 for all opencryptoki packages for jammy (which is 3.17+) and newer (up to mantic).

[Launchpad Janitor (janitor)]

This bug was fixed in the package opencryptoki - 3.20.0+dfsg-0ubuntu2

---------------
opencryptoki (3.20.0+dfsg-0ubuntu2) mantic; urgency=medium

  * d/rules, d/triggers, d/libopencryptoki0.install: keep tmp/etc/ld.so.conf.d
    content, add opencryptoki conf file to /etc/ld.so.conf.d/
    and add trigger for ldconfig to allow tools like
    p11sak to find libopencryptoki shared object file. (LP: #2022088)
  * d/control, d/compat: Bump dh compat level to 13 to remove dh-exec
    dependency and remove executable flags from d/*.install*, d/*.links*.
  * d/rules: remove the explicit dh_missing call, and rely instead on dh
    to call it and erroring out on missing files.
  * d/opencryptoki.install: install entire content of etc/opencryptoki build
    folder to esp. catch all existing conf files and on top make the arch-
    specific file 'opencryptoki.install.s390x' obsolete. (LP: #2018911)
  * d/opencryptoki.postinst: change strength.conf file permissions to 640
    which is checked/forced by the code. (LP: #2018908)

 -- Frank Heimes <email address hidden> Wed, 31 May 2023 21:28:48 +0200

[Steve Langasek (vorlon)]

Hello bugproxy, or anyone else affected,

Accepted opencryptoki into lunar-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/opencryptoki/3.20.0+dfsg-0ubuntu1.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-lunar to verification-done-lunar. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-lunar. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Frank Heimes (fheimes)]

The updated opencryptoki package for lunar (currently in -proposed) was successfully verified - see:
https://launchpadlibrarian.net/674272012/SRU_validation_23.04.txt
Hence I'm adjusting the tag accordingly.

[Andreas Hasenack (ahasenack)]

Note that this is already fixed in lunar release: this upload makes absolutely no changes to d/opencryptoki.install, it just removes the s390x-specific install file, in what concerns this bug. So the changelog entry is not 100% correct, but since this is in proposed and verified already, I don't see a reason to reject it just because of this d/changelog inconsistency.

I did double check with Frank that indeed there are no further changes needed to d/opencryptoki.install, and that it's just the changelog entry that shouldn't have called it out.

[Launchpad Janitor (janitor)]

This bug was fixed in the package opencryptoki - 3.20.0+dfsg-0ubuntu1.1

---------------
opencryptoki (3.20.0+dfsg-0ubuntu1.1) lunar; urgency=medium

  * Add d/p/lp-2022088-fix-p11sak-failure-to-find-libopencryptoki.so.patch
    to fix the failure that p11sak is not able to find libopencryptoki as
    plugin, by adjusting 'default_pkcs11lib'. (LP: #2022088)
  * d/opencryptoki.install: install full set of etc/opencryptoki build
    folder to esp. catch all generated conf files and on top make the arch-
    specific file 'opencryptoki.install.s390x' obsolete. (LP: #2018911)
  * d/opencryptoki.postinst: change strength.conf file permissions to 640
    which is checked/forced by the opencryptoki code. (LP: #2018908)

 -- Frank Heimes <email address hidden> Mon, 12 Jun 2023 12:28:36 +0200

[Andreas Hasenack (ahasenack)]

The verification of the Stable Release Update for opencryptoki has completed successfully and the package is now being released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.

[Steve Langasek (vorlon)]

Hello bugproxy, or anyone else affected,

Accepted opencryptoki into kinetic-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/opencryptoki/3.18.0+dfsg-0ubuntu2.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-kinetic to verification-done-kinetic. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-kinetic. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Frank Heimes (fheimes)]

opencryptoki/3.18.0+dfsg-0ubuntu2.1 from kinetic-proposed was successfully verified, see
https://bugs.launchpad.net/ubuntu/+source/opencryptoki/+bug/2018908/comments/17

updating the tags accordingly...

[Steve Langasek (vorlon)]

An upload of opencryptoki to jammy-proposed has been rejected from the upload queue for the following reason: "to be reuploaded with fixed debian/libopencryptoki0.links file".

[Launchpad Janitor (janitor)]

This bug was fixed in the package opencryptoki - 3.18.0+dfsg-0ubuntu2.1

---------------
opencryptoki (3.18.0+dfsg-0ubuntu2.1) kinetic; urgency=medium

  * Add d/p/lp-2022088-fix-p11sak-failure-to-find-libopencryptoki.so.patch
    to fix the failure that p11sak is not able to find libopencryptoki as
    plugin, by adjusting 'default_pkcs11lib'. (LP: #2022088)
  * d/opencryptoki.install: install full set of etc/opencryptoki build
    folder to esp. catch all generated conf files and on top make the arch-
    specific file 'opencryptoki.install.s390x' obsolete. (LP: #2018911)
  * d/opencryptoki.postinst: change strength.conf file permissions to 640
    which is checked/forced by the opencryptoki code. (LP: #2018908)

 -- Frank Heimes <email address hidden> Thu, 29 Jun 2023 09:39:27 +0200

[Steve Langasek (vorlon)]

Hello bugproxy, or anyone else affected,

Accepted opencryptoki into jammy-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/opencryptoki/3.17.0+dfsg+20220202.b40982e-0ubuntu1.2 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-jammy to verification-done-jammy. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-jammy. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Frank Heimes (fheimes)]

The opencryptoki/3.17.0+dfsg+20220202.b40982e-0ubuntu1.2 package from jammy-proposed was successfully verified, please see:
https://bugs.launchpad.net/ubuntu/+source/opencryptoki/+bug/2018908/comments/21
Updating the tags accordingly...

[Launchpad Janitor (janitor)]

This bug was fixed in the package opencryptoki - 3.17.0+dfsg+20220202.b40982e-0ubuntu1.2

---------------
opencryptoki (3.17.0+dfsg+20220202.b40982e-0ubuntu1.2) jammy; urgency=medium

  * Add d/p/lp-2022088-fix-p11sak-failure-to-find-libopencryptoki.so.patch
    to fix the failure that p11sak is not able to find libopencryptoki as
    plugin, by adjusting 'default_pkcs11lib'. (LP: #2022088)
  * d/opencryptoki.install: install full set of etc/opencryptoki build
    folder to esp. catch all generated conf files and on top make the arch-
    specific file 'opencryptoki.install.s390x' obsolete. (LP: #2018911)
  * d/libopencryptoki0.links{.s390x} Merge files, since the content of the
    s390x version of this file applies in all cases,
    and remove leading slash in path for consistency reasons.
  * Assign pkcs11 group to p11sak_defined_attrs.conf and strength.conf
    in debian/opencryptoki.postinst rather than in Makefile.am and add
    d/p/lp-1982842-move-pkcs11-group-assigment-from-makefile-to-postinst.patch
    to solve "invalid group ‘pkcs11’" issues during build.
  * d/opencryptoki.postinst: change strength.conf file permissions to 640
    which is checked/forced by the opencryptoki code. (LP: #2018908)

 -- Frank Heimes <email address hidden> Fri, 30 Jun 2023 10:11:32 +0200

[bugproxy (bugproxy)]

------- Comment From <email address hidden> 2023-08-07 09:09 EDT-------
Fix has been released to Jammy. With that, we can close this bug.
Thanks everyone for all your work!

==> Changing status to "CLOSED"