From 84c62eb68b16af02a84f310e7b3bc05e6794aaf7 Mon Sep 17 00:00:00 2001 From: Florian Klink Date: Sat, 7 May 2022 21:02:48 +0200 Subject: feat(ops/modules/open_eid.nix): use p11-kit-proxy MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit … instead of onepin-opensc-pkcs11. This acts as a glue to multiple PKCS#11 modules, and reads configuration files from /etc/pkcs11/modules. p11-kit is also used to propagate the system trust store to NSS: https://p11-glue.github.io/p11-glue/sharing-trust-policy.html See-Also: https://p11-glue.github.io/p11-glue/p11-kit.html Change-Id: I135c3a80a4eea0bd06f6b00089dc197c82476746 Reviewed-on: https://cl.tvl.fyi/c/depot/+/5533 Reviewed-by: flokli Reviewed-by: tazjin Autosubmit: flokli Tested-by: BuildkiteCI --- ops/modules/open_eid.nix | 18 +++++++++++------- 1 file changed, 11 insertions(+), 7 deletions(-) diff --git a/ops/modules/open_eid.nix b/ops/modules/open_eid.nix index e3e686f3f62d..b073790d5c12 100644 --- a/ops/modules/open_eid.nix +++ b/ops/modules/open_eid.nix @@ -2,25 +2,29 @@ { pkgs, ... }: let - # Wrapper script to add EID support to browsers. Each user needs to - # run this themselves, it does not work on a system level due to a - # bug in Chromium: + # Wrapper script to tell to Chrome/Chromium to use p11-kit-proxy to load + # security devices. + # Each user needs to run this themselves, it does not work on a system level + # due to a bug in Chromium: # # https://bugs.chromium.org/p/chromium/issues/detail?id=16387 # - # This is based on the upstream setup script for Debian-derivatives: - # https://github.com/open-eid/linux-installer/blob/master/esteid-update-nssdb setup-browser-eid = pkgs.writeShellScriptBin "setup-browser-eid" '' NSSDB="''${HOME}/.pki/nssdb" mkdir -p ''${NSSDB} - ${pkgs.nssTools}/bin/modutil -force -dbdir sql:$NSSDB -add opensc-pkcs11 \ - -libfile ${pkgs.opensc}/lib/onepin-opensc-pkcs11.so -mechanisms FRIENDLY + ${pkgs.nssTools}/bin/modutil -force -dbdir sql:$NSSDB -add p11-kit-proxy \ + -libfile ${pkgs.p11-kit}/lib/p11-kit-proxy.so ''; in { services.pcscd.enable = true; + # Tell p11-kit to load onepin-opensc-pkcs11.so + environment.etc."pkcs11/modules/onepin-opensc-pkcs11".text = '' + module: ${pkgs.opensc}/lib/onepin-opensc-pkcs11.so + ''; + environment.systemPackages = with pkgs; [ qdigidoc setup-browser-eid -- cgit 1.4.1