openssh unix dev - Jan 2017 - DEFAULT_PKCS11_WHITELIST on 64-bit Linux systems

Hello,

On RHEL 6/amd64, the stock value for DEFAULT_PKCS11_WHITELIST is not
very useful. On such systems, /usr/lib64/* would need to be added to the
pattern list. Although users can specify the -P option every time they
launch ssh-agent, it might be nice to provide a means to specify a
default whitelist at build-time.

It's tempting to suggest that configure should automatically supply a
reasonable value for the whitelist based on the platform, but supporting
an option to configure would seem to be the simpler and safer solution.

% ./configure --with-default-pkcs11-whitelist="/usr/lib64/*'

any thought?

-- 
Iain Morgan

On Wed, 28 Dec 2016, Iain Morgan wrote:
> Hello,
> 
> On RHEL 6/amd64, the stock value for DEFAULT_PKCS11_WHITELIST is not
> very useful. On such systems, /usr/lib64/* would need to be added to the
> pattern list. Although users can specify the -P option every time they
> launch ssh-agent, it might be nice to provide a means to specify a
> default whitelist at build-time.
> 
> It's tempting to suggest that configure should automatically supply a
> reasonable value for the whitelist based on the platform, but supporting
> an option to configure would seem to be the simpler and safer solution.
> 
> % ./configure --with-default-pkcs11-whitelist="/usr/lib64/*'
Sounds eminently reasonable. Maybe we could make the portable default
"/usr/lib*/*,/usr/local/lib*/*" too?

-d

On 12/30/2016 02:40 AM, Damien Miller wrote:
> On Wed, 28 Dec 2016, Iain Morgan wrote:
>
>> Hello,
>>
>> On RHEL 6/amd64, the stock value for DEFAULT_PKCS11_WHITELIST is not
>> very useful. On such systems, /usr/lib64/* would need to be added to
the
>> pattern list. Although users can specify the -P option every time they
>> launch ssh-agent, it might be nice to provide a means to specify a
>> default whitelist at build-time.
>>
>> It's tempting to suggest that configure should automatically supply
a
>> reasonable value for the whitelist based on the platform, but
supporting
>> an option to configure would seem to be the simpler and safer solution.
>>
>> % ./configure --with-default-pkcs11-whitelist="/usr/lib64/*'
> Sounds eminently reasonable. Maybe we could make the portable default
> "/usr/lib*/*,/usr/local/lib*/*" too?
Please do,
these paths look sane. In RHEL/Fedora, all the pkcs11 libraries are 
under /usr/lib64/pkcs11/ on x86_64. Not sure, where else they can be on 
other systems, but your wildcard matches all of them.

Regards,

-- 
Jakub Jelen
Software Engineer
Security Technologies
Red Hat