rpms/opencryptoki
7
0
Fork 0
Code Issues Pull Requests Releases Activity

- Resolves: RHEL-136096, Update to 3.27.0

Browse Source 
- Resolves: RHEL-157524, openCryptoki soft token: support PKCS #11 V3.2 ML-DSA and ML-KEM
- Resolves: RHEL-157679, openCryptoki CCA token: support PKCS #11 V3.2 ML-DSA
- Resolves: RHEL-157806, openCryptoki EP11 token: support PKCS #11 V3.2 ML-DSA and ML-KEM
- Resolves: RHEL-169485, openCryptoki: ep11_specific.c syslog warning even for identically configured control points
- Resolves: RHEL-171563, Fix CVE-2026-40253
This commit is contained in:
Than Ngo 2026-07-28 17:12:30 +02:00
parent 77ae2273bb
commit ab39dfa60e
6 changed files with 51 additions and 470 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
.gitignore vendored
View File

@ -37,3 +37,4 @@ opencryptoki-2.3.1.tar.gz
/opencryptoki-3.24.0.tar.gz
/opencryptoki-3.25.0.tar.gz
/opencryptoki-3.26.0.tar.gz
/opencryptoki-3.27.0.tar.gz

2
opencryptoki-3.25.0-p11sak.patch → opencryptoki-3.25.0-buildroot-install.patch
View File

@ -41,7 +41,7 @@ diff -up opencryptoki-3.25.0/Makefile.am.me opencryptoki-3.25.0/Makefile.am
test -f $(DESTDIR)$(sysconfdir)/opencryptoki || $(MKDIR_P) $(DESTDIR)$(sysconfdir)/opencryptoki || true
test -f $(DESTDIR)$(sysconfdir)/opencryptoki/opencryptoki.conf || $(INSTALL) -m 644 $(srcdir)/usr/sbin/pkcsslotd/opencryptoki.conf $(DESTDIR)$(sysconfdir)/opencryptoki/opencryptoki.conf || true
- test -f $(DESTDIR)$(sysconfdir)/opencryptoki/strength.conf || $(INSTALL) -m 640 -o root -g $(pkcs_group) -T $(srcdir)/doc/strength-example.conf $(DESTDIR)$(sysconfdir)/opencryptoki/strength.conf || true
+ test -f $(DESTDIR)$(sysconfdir)/opencryptoki/strength.conf || $(INSTALL) -m 640 -T $(srcdir)/doc/strength-example.conf $(DESTDIR)$(sysconfdir)/opencryptoki/strength.conf || true
+ test -f $(DESTDIR)$(sysconfdir)/opencryptoki/strength.conf || $(INSTALL) -m 640 -o root -T $(srcdir)/doc/strength-example.conf $(DESTDIR)$(sysconfdir)/opencryptoki/strength.conf || true
endif
if !AIX
$(MKDIR_P) $(DESTDIR)/etc/ld.so.conf.d

453
opencryptoki-3.26.0-CVE-3-2026-23893.patch
View File

@ -1,453 +0,0 @@
commit a1aaf9f9080202f48570d3a207d0595db159f99c
Author: Pavel Kohout <pavel@aisle.com>
Date: Tue Jan 13 00:00:00 2026 +0000
Fix symlink-following vulnerabilities (CWE-59)
Multiple symlink-following vulnerabilities exist in OpenCryptoki that run
in privileged contexts. These allow a token-group user to redirect file
operations to arbitrary filesystem targets by planting symlinks in
group-writable token directories, resulting in privilege escalation or
data exposure.
Affected components:
1. pkcstok_admin: set_file_permissions() uses stat() which follows symlinks,
then applies chmod/chown to the symlink target.
2. pkcstok_migrate: fopen() follows symlinks, then set_perm() modifies the
target permissions.
3. loadsave.c: Multiple wrapper functions use fopen() followed by set_perm().
4. hsm_mk_change.c: hsm_mk_change_op_open() uses fopen() followed by
hsm_mk_change_op_set_perm().
5. pbkdf.c: fopen() followed by set_perms() in two locations.
This fix:
- Introduces fopen_nofollow() helper in platform.h
- Checks for O_NOFOLLOW at compile time (not hardcoded per-platform)
- On platforms with O_NOFOLLOW: uses open(O_NOFOLLOW) + fdopen() for atomic
symlink rejection (race-condition free)
- On platforms without O_NOFOLLOW: falls back to lstat() + fopen() and emits
a compiler warning so the unsafe fallback doesn't go unnoticed
- Updates all affected wrapper functions to use fopen_nofollow()
- pkcstok_admin: Uses lstat() instead of stat() and skips symlinks
Reported-by: Pavel Kohout, Aisle Research, www.aisle.com
Signed-off-by: Pavel Kohout <pavel@aisle.com>
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
diff --git a/usr/lib/common/loadsave.c b/usr/lib/common/loadsave.c
index 18b8aa04..f9c0cc7f 100644
--- a/usr/lib/common/loadsave.c
+++ b/usr/lib/common/loadsave.c
@@ -68,9 +68,17 @@ static FILE *open_token_object_path(char *buf, size_t buflen,
STDLL_TokData_t *tokdata, const char *path,
const char *mode)
{
+ FILE *fp;
+
if (get_token_object_path(buf, buflen, tokdata, path, NULL) < 0)
return NULL;
- return fopen(buf, mode);
+
+ /* CWE-59 fix: Use fopen_nofollow to prevent symlink attacks */
+ fp = fopen_nofollow(buf, mode);
+ if (fp == NULL && errno == ELOOP)
+ TRACE_ERROR("Refusing to follow symlink: %s\n", buf);
+
+ return fp;
}
static FILE *open_token_object_path_new(char *newbuf, size_t newbuflen,
@@ -78,11 +86,19 @@ static FILE *open_token_object_path_new(char *newbuf, size_t newbuflen,
STDLL_TokData_t *tokdata,
const char *path, const char *mode)
{
+ FILE *fp;
+
if (get_token_object_path(newbuf, newbuflen, tokdata, path, ".TMP") < 0)
return NULL;
if (get_token_object_path(basebuf, basebuflen, tokdata, path, NULL) < 0)
return NULL;
- return fopen(newbuf, mode);
+
+ /* CWE-59 fix: Use fopen_nofollow to prevent symlink attacks */
+ fp = fopen_nofollow(newbuf, mode);
+ if (fp == NULL && errno == ELOOP)
+ TRACE_ERROR("Refusing to follow symlink: %s\n", newbuf);
+
+ return fp;
}
static int get_token_data_store_path(char *buf, size_t buflen,
@@ -101,9 +117,17 @@ static FILE *open_token_data_store_path(char *buf, size_t buflen,
STDLL_TokData_t *tokdata,
const char *path, const char *mode)
{
+ FILE *fp;
+
if (get_token_data_store_path(buf, buflen, tokdata, path, NULL) < 0)
return NULL;
- return fopen(buf, mode);
+
+ /* CWE-59 fix: Use fopen_nofollow to prevent symlink attacks */
+ fp = fopen_nofollow(buf, mode);
+ if (fp == NULL && errno == ELOOP)
+ TRACE_ERROR("Refusing to follow symlink: %s\n", buf);
+
+ return fp;
}
static FILE *open_token_data_store_path_new(char *newbuf, size_t newbuflen,
@@ -111,11 +135,19 @@ static FILE *open_token_data_store_path_new(char *newbuf, size_t newbuflen,
STDLL_TokData_t *tokdata,
const char *path, const char *mode)
{
+ FILE *fp;
+
if (get_token_data_store_path(newbuf, newbuflen, tokdata, path, ".TMP") < 0)
return NULL;
if (get_token_data_store_path(basebuf, basebuflen, tokdata, path, NULL) < 0)
return NULL;
- return fopen(newbuf, mode);
+
+ /* CWE-59 fix: Use fopen_nofollow to prevent symlink attacks */
+ fp = fopen_nofollow(newbuf, mode);
+ if (fp == NULL && errno == ELOOP)
+ TRACE_ERROR("Refusing to follow symlink: %s\n", newbuf);
+
+ return fp;
}
static FILE *open_token_object_index(char *buf, size_t buflen,
@@ -127,17 +159,27 @@ static FILE *open_token_object_index(char *buf, size_t buflen,
static FILE *open_token_nvdat(char *buf, size_t buflen,
STDLL_TokData_t *tokdata, const char *mode)
{
+ FILE *fp;
+
if (ock_snprintf(buf, buflen, "%s/" PK_LITE_NV, tokdata->data_store)) {
TRACE_ERROR("NVDAT.TOK file name buffer overflow\n");
return NULL;
}
- return fopen(buf, mode);
+
+ /* CWE-59 fix: Use fopen_nofollow to prevent symlink attacks */
+ fp = fopen_nofollow(buf, mode);
+ if (fp == NULL && errno == ELOOP)
+ TRACE_ERROR("Refusing to follow symlink: %s\n", buf);
+
+ return fp;
}
static FILE *open_token_nvdat_new(char *newbuf, size_t newbuflen,
char *basebuf, size_t basebuflen,
STDLL_TokData_t *tokdata, const char *mode)
{
+ FILE *fp;
+
if (ock_snprintf(newbuf, newbuflen, "%s/" PK_LITE_NV ".TMP",
tokdata->data_store)) {
TRACE_ERROR("NVDAT.TOK file name buffer overflow\n");
@@ -148,7 +190,13 @@ static FILE *open_token_nvdat_new(char *newbuf, size_t newbuflen,
TRACE_ERROR("NVDAT.TOK file name buffer overflow\n");
return NULL;
}
- return fopen(newbuf, mode);
+
+ /* CWE-59 fix: Use fopen_nofollow to prevent symlink attacks */
+ fp = fopen_nofollow(newbuf, mode);
+ if (fp == NULL && errno == ELOOP)
+ TRACE_ERROR("Refusing to follow symlink: %s\n", newbuf);
+
+ return fp;
}
static CK_RV close_token_file_new(FILE * fp, CK_RV rc,
@@ -289,9 +337,12 @@ CK_RV save_token_object(STDLL_TokData_t *tokdata, OBJECT *obj)
// we didn't find it...either the index file doesn't exist or this
// is a new object...
//
- fp = fopen(fname, "a");
+ fp = fopen_nofollow(fname, "a");
if (!fp) {
- TRACE_ERROR("fopen(%s): %s\n", fname, strerror(errno));
+ if (errno == ELOOP)
+ TRACE_ERROR("Refusing to follow symlink: %s\n", fname);
+ else
+ TRACE_ERROR("fopen(%s): %s\n", fname, strerror(errno));
return CKR_FUNCTION_FAILED;
}
@@ -663,11 +714,14 @@ CK_RV load_token_data_old(STDLL_TokData_t *tokdata, CK_SLOT_ID slot_id)
if (errno == ENOENT) {
init_token_data(tokdata, slot_id);
- fp = fopen(fname, "r");
+ fp = fopen_nofollow(fname, "r");
if (!fp) {
// were really hosed here since the created
// did not occur
- TRACE_ERROR("fopen(%s): %s\n", fname, strerror(errno));
+ if (errno == ELOOP)
+ TRACE_ERROR("Refusing to follow symlink: %s\n", fname);
+ else
+ TRACE_ERROR("fopen(%s): %s\n", fname, strerror(errno));
rc = CKR_FUNCTION_FAILED;
goto out_unlock;
}
@@ -2345,11 +2399,14 @@ CK_RV load_token_data(STDLL_TokData_t *tokdata, CK_SLOT_ID slot_id)
if (errno == ENOENT) {
init_token_data(tokdata, slot_id);
- fp = fopen(fname, "r");
+ fp = fopen_nofollow(fname, "r");
if (!fp) {
// were really hosed here since the created
// did not occur
- TRACE_ERROR("fopen(%s): %s\n", fname, strerror(errno));
+ if (errno == ELOOP)
+ TRACE_ERROR("Refusing to follow symlink: %s\n", fname);
+ else
+ TRACE_ERROR("fopen(%s): %s\n", fname, strerror(errno));
rc = CKR_FUNCTION_FAILED;
goto out_unlock;
}
diff --git a/usr/lib/common/platform.h b/usr/lib/common/platform.h
index 799821b5..51cc1c73 100644
--- a/usr/lib/common/platform.h
+++ b/usr/lib/common/platform.h
@@ -7,7 +7,16 @@
* found in the file LICENSE file or at
* https://opensource.org/licenses/cpl1.0.php
*/
+#ifndef PLATFORM_H
+#define PLATFORM_H
+
#include <dlfcn.h>
+#include <stdio.h>
+#include <fcntl.h>
+#include <unistd.h>
+#include <string.h>
+#include <errno.h>
+#include <sys/stat.h>
#if defined(_AIX)
#include "aix/getopt.h"
@@ -30,10 +39,81 @@
/* for htobexx, htolexx, bexxtoh and lexxtoh macros */
#include <endian.h>
/* macros from bsdlog and friends */
-#include <stdio.h>
#include <err.h>
#define OCK_API_LIBNAME "libopencryptoki.so"
#define DYNLIB_LDFLAGS (RTLD_NOW)
#endif /* _AIX */
+
+/*
+ * Check for O_NOFOLLOW support at compile time.
+ * If not available, fall back to lstat() + fopen() (has TOCTOU race).
+ */
+#ifndef O_NOFOLLOW
+#define OCK_NO_O_NOFOLLOW 1
+#warning "O_NOFOLLOW not supported, symlink protection uses racy lstat() fallback!"
+#endif
+
+/*
+ * CWE-59 fix: Open file without following symlinks.
+ *
+ * On platforms with O_NOFOLLOW support:
+ * Uses open(O_NOFOLLOW) + fdopen() for atomic symlink rejection.
+ *
+ * On platforms without O_NOFOLLOW (e.g., older AIX):
+ * Falls back to lstat() + fopen(). This has a TOCTOU race condition,
+ * but still catches pre-planted symlinks which is the common attack
+ * scenario. Better than no protection at all.
+ *
+ * Returns NULL with errno=ELOOP if path is a symlink.
+ */
+static inline FILE *fopen_nofollow(const char *path, const char *mode)
+{
+#ifdef OCK_NO_O_NOFOLLOW
+ /*
+ * Fallback for platforms without O_NOFOLLOW: use lstat() check.
+ * This has a TOCTOU race but catches pre-planted symlinks.
+ */
+ struct stat sb;
+
+ if (lstat(path, &sb) == 0) {
+ if (S_ISLNK(sb.st_mode)) {
+ errno = ELOOP;
+ return NULL;
+ }
+ }
+ /* Note: if lstat fails (e.g., file doesn't exist for "w" mode),
+ * we proceed with fopen() which will handle the error appropriately */
+ return fopen(path, mode);
+#else
+ /* Preferred: atomic symlink rejection via O_NOFOLLOW */
+ int flags = O_NOFOLLOW;
+ int fd;
+ FILE *fp;
+
+ /* Determine flags based on mode */
+ if (mode[0] == 'r') {
+ flags |= (mode[1] == '+') ? O_RDWR : O_RDONLY;
+ } else if (mode[0] == 'w') {
+ flags |= O_CREAT | O_TRUNC | ((mode[1] == '+') ? O_RDWR : O_WRONLY);
+ } else if (mode[0] == 'a') {
+ flags |= O_CREAT | O_APPEND | ((mode[1] == '+') ? O_RDWR : O_WRONLY);
+ } else {
+ return NULL;
+ }
+
+ fd = open(path, flags, 0600);
+ if (fd < 0)
+ return NULL;
+
+ fp = fdopen(fd, mode);
+ if (fp == NULL) {
+ close(fd);
+ return NULL;
+ }
+ return fp;
+#endif
+}
+
+#endif /* PLATFORM_H */
diff --git a/usr/lib/hsm_mk_change/hsm_mk_change.c b/usr/lib/hsm_mk_change/hsm_mk_change.c
index f40dfb43..8c66546f 100644
--- a/usr/lib/hsm_mk_change/hsm_mk_change.c
+++ b/usr/lib/hsm_mk_change/hsm_mk_change.c
@@ -623,9 +623,13 @@ static FILE* hsm_mk_change_op_open(const char *id, CK_SLOT_ID slot_id,
TRACE_DEVEL("file to open: %s mode: %s\n", hsm_mk_change_file, mode);
- fp = fopen(hsm_mk_change_file, mode);
+ /* CWE-59 fix: Use fopen_nofollow to prevent symlink attacks */
+ fp = fopen_nofollow(hsm_mk_change_file, mode);
if (fp == NULL) {
- TRACE_ERROR("%s fopen(%s, %s): %s\n", __func__,
+ if (errno == ELOOP)
+ TRACE_ERROR("Refusing to follow symlink: %s\n", hsm_mk_change_file);
+ else
+ TRACE_ERROR("%s fopen(%s, %s): %s\n", __func__,
hsm_mk_change_file, mode, strerror(errno));
}
diff --git a/usr/lib/icsf_stdll/pbkdf.c b/usr/lib/icsf_stdll/pbkdf.c
index 47d1b97c..91230804 100644
--- a/usr/lib/icsf_stdll/pbkdf.c
+++ b/usr/lib/icsf_stdll/pbkdf.c
@@ -26,6 +26,7 @@
#include "h_extern.h"
#include "pbkdf.h"
#include "trace.h"
+#include "platform.h"
CK_RV get_randombytes(unsigned char *output, int bytes)
@@ -546,9 +547,13 @@ CK_RV secure_racf(STDLL_TokData_t *tokdata,
totallen = outputlen + AES_INIT_VECTOR_SIZE;
snprintf(fname, sizeof(fname), "%s/%s/%s", CONFIG_PATH, tokname, RACFFILE);
- fp = fopen(fname, "w");
+ /* CWE-59 fix: Use fopen_nofollow to prevent symlink attacks */
+ fp = fopen_nofollow(fname, "w");
if (!fp) {
- TRACE_ERROR("fopen failed: %s\n", strerror(errno));
+ if (errno == ELOOP)
+ TRACE_ERROR("Refusing to follow symlink: %s\n", fname);
+ else
+ TRACE_ERROR("fopen failed: %s\n", strerror(errno));
return CKR_FUNCTION_FAILED;
}
@@ -619,9 +624,13 @@ CK_RV secure_masterkey(STDLL_TokData_t *tokdata,
/* get the total length */
totallen = outputlen + SALTSIZE;
- fp = fopen(fname, "w");
+ /* CWE-59 fix: Use fopen_nofollow to prevent symlink attacks */
+ fp = fopen_nofollow(fname, "w");
if (!fp) {
- TRACE_ERROR("fopen failed: %s\n", strerror(errno));
+ if (errno == ELOOP)
+ TRACE_ERROR("Refusing to follow symlink: %s\n", fname);
+ else
+ TRACE_ERROR("fopen failed: %s\n", strerror(errno));
return CKR_FUNCTION_FAILED;
}
diff --git a/usr/sbin/pkcstok_admin/pkcstok_admin.c b/usr/sbin/pkcstok_admin/pkcstok_admin.c
index 9912804e..d144cc04 100644
--- a/usr/sbin/pkcstok_admin/pkcstok_admin.c
+++ b/usr/sbin/pkcstok_admin/pkcstok_admin.c
@@ -336,11 +336,18 @@ static int set_file_permissions(const char *fname, const struct group *group,
pr_verbose("Setting permissions for '%s' with group '%s'", fname,
group->gr_name);
- if (stat(fname, &sb) != 0) {
+ /* CWE-59 fix: Use lstat to detect symlinks */
+ if (lstat(fname, &sb) != 0) {
warnx("'%s' does not exist.", fname);
return -1;
}
+ /* Only process regular files and directories (CWE-59 fix) */
+ if (!S_ISREG(sb.st_mode) && !S_ISDIR(sb.st_mode)) {
+ warnx("Skipping '%s': not a regular file or directory.", fname);
+ return 0;
+ }
+
if (sb.st_uid != 0) {
/* owner is not root */
pwd = getpwuid(sb.st_uid);
diff --git a/usr/sbin/pkcstok_migrate/pkcstok_migrate.c b/usr/sbin/pkcstok_migrate/pkcstok_migrate.c
index 12b605b5..9579e236 100644
--- a/usr/sbin/pkcstok_migrate/pkcstok_migrate.c
+++ b/usr/sbin/pkcstok_migrate/pkcstok_migrate.c
@@ -48,6 +48,7 @@
#include "local_types.h"
#include "h_extern.h"
#include "slotmgr.h" // for ock_snprintf
+#include "platform.h"
#define OCK_TOOL
#include "pkcs_utils.h"
@@ -77,9 +78,14 @@ static FILE *open_datastore_file(char *buf, size_t buflen,
TRACE_ERROR("Path overflow for datastore file %s\n", file);
return NULL;
}
- res = fopen(buf, mode);
- if (!res)
- TRACE_ERROR("fopen(%s) failed, errno=%s\n", buf, strerror(errno));
+ /* CWE-59 fix: Use fopen_nofollow to prevent symlink attacks */
+ res = fopen_nofollow(buf, mode);
+ if (!res) {
+ if (errno == ELOOP)
+ TRACE_ERROR("Refusing to follow symlink: %s\n", buf);
+ else
+ TRACE_ERROR("fopen(%s) failed, errno=%s\n", buf, strerror(errno));
+ }
return res;
}
@@ -94,9 +100,14 @@ static FILE *open_tokenobject(char *buf, size_t buflen,
file, tokenobj);
return NULL;
}
- res = fopen(buf, mode);
- if (!res)
- TRACE_ERROR("fopen(%s) failed, errno=%s\n", buf, strerror(errno));
+ /* CWE-59 fix: Use fopen_nofollow to prevent symlink attacks */
+ res = fopen_nofollow(buf, mode);
+ if (!res) {
+ if (errno == ELOOP)
+ TRACE_ERROR("Refusing to follow symlink: %s\n", buf);
+ else
+ TRACE_ERROR("fopen(%s) failed, errno=%s\n", buf, strerror(errno));
+ }
return res;
}

24
opencryptoki-3.27.0-coverity.patch Normal file
View File

@ -0,0 +1,24 @@
TESTCASES: Fix Coverity finding: Using uninitialized value
1. Defect type: UNINIT
1. opencryptoki-3.27.0/testcases/crypto/rsa_func.c:2367:5: var_decl: Declaring variable "oaep_params" without initializer.
48. opencryptoki-3.27.0/testcases/crypto/rsa_func.c:2648:13: uninit_use: Using uninitialized value "oaep_params.hashAlg".
49. opencryptoki-3.27.0/testcases/crypto/rsa_func.c:2648:13: uninit_use: Using uninitialized value "oaep_params.mgf".
# 2646| NULL, &cipher_len, NULL);
# 2647| if (rc != CKR_OK) {
# 2648|-> if (rc == CKR_MECHANISM_PARAM_INVALID &&
# 2649| encaps_mech.mechanism == CKM_RSA_PKCS_OAEP &&
# 2650| is_ep11_token(slot_id) &&
diff -up opencryptoki-3.27.0/testcases/crypto/rsa_func.c.orig opencryptoki-3.27.0/testcases/crypto/rsa_func.c
--- opencryptoki-3.27.0/testcases/crypto/rsa_func.c.orig 2026-07-22 14:10:57.771848322 +0200
+++ opencryptoki-3.27.0/testcases/crypto/rsa_func.c 2026-07-22 16:00:07.212999532 +0200
@@ -2364,7 +2364,7 @@ CK_RV do_EncapsDecapsRSA(struct GENERATE
CK_BYTE_PTR cipher = NULL;
CK_ULONG cipher_len;
CK_MECHANISM encaps_mech, mech;
- CK_RSA_PKCS_OAEP_PARAMS oaep_params;
+ CK_RSA_PKCS_OAEP_PARAMS oaep_params = {0};
CK_BYTE clear[32], encypted[32], re_cipher[32];
CK_ULONG encrypted_len = 32, re_cipher_len = 32;

39
opencryptoki.spec
View File

@ -1,7 +1,7 @@
Name: opencryptoki
Summary: Implementation of the PKCS#11 (Cryptoki) specification v3.0 and partially v3.1
Version: 3.26.0
Release: 2%{?dist}
Version: 3.27.0
Release: 1%{?dist}
License: CPL-1.0
URL: https://github.com/opencryptoki/opencryptoki
Source0: https://github.com/opencryptoki/%{name}/archive/v%{version}/%{name}-%{version}.tar.gz
@ -9,18 +9,19 @@ Source0: https://github.com/opencryptoki/%{name}/archive/v%{version}/%{name}-%{v
Source1: opencryptoki.sysusers.conf
# fix install problem in buildroot
Patch1: opencryptoki-3.25.0-p11sak.patch
Patch: opencryptoki-3.25.0-buildroot-install.patch
# tmpfiles.d config files for image mode
Patch2: opencryptoki-3.24.0-tmpfiles-image-mode.patch
Patch: opencryptoki-3.24.0-tmpfiles-image-mode.patch
# everything using /var/lock should be fixed in the end to use /run/lock
# https://gitlab.com/fedora/bootc/base-images/-/issues/48
Patch3: opencryptoki-lockdir-image-mode.patch
Patch: opencryptoki-lockdir-image-mode.patch
# Fix Coverity finding: Using uninitialized value
Patch: opencryptoki-3.27.0-coverity.patch
# upstream patches
# CVE-3-2026-23893
Patch100: opencryptoki-3.26.0-CVE-3-2026-23893.patch
Requires(pre): coreutils
Requires: (selinux-policy >= 38.1.14-1 if selinux-policy-targeted)
@ -56,7 +57,7 @@ Requires(postun): systemd
%description
Opencryptoki implements the PKCS#11 specification v3.0 and partially v3.1
Opencryptoki implements the PKCS#11 specification v3.0 and partially v3.1, v3.2
for a set of cryptographic hardware, such as IBM 4767, 4768, 4769 and 4770
crypto cards, and the Trusted Platform Module (TPM) chip. Opencryptoki also
brings a software token implementation that can be used without any cryptographic
@ -69,7 +70,7 @@ Summary: The run-time libraries for opencryptoki package
Requires(pre): shadow-utils
%description libs
Opencryptoki implements the PKCS#11 specification v3.0 and partially v3.1
Opencryptoki implements the PKCS#11 specification v3.0 and partially v3.1, v3.2
for a set of cryptographic hardware, such as IBM 4767, 4768, 4769 and 4770
crypto cards, and the Trusted Platform Module (TPM) chip. Opencryptoki also
brings a software token implementation that can be used without any cryptographic
@ -95,7 +96,7 @@ Requires: %{name}-libs%{?_isa} = %{version}-%{release}
Provides: %{name}(token)
%description swtok
Opencryptoki implements the PKCS#11 specification v3.0 and partially v3.1
Opencryptoki implements the PKCS#11 specification v3.0 and partially v3.1, v3.2
for a set of cryptographic hardware, such as IBM 4767, 4768, 4769 and 4770
crypto cards, and the Trusted Platform Module (TPM) chip. Opencryptoki also
brings a software token implementation that can be used without any cryptographic
@ -111,7 +112,7 @@ Requires: %{name}-libs%{?_isa} = %{version}-%{release}
Provides: %{name}(token)
%description tpmtok
Opencryptoki implements the PKCS#11 specification v3.0 and partially v3.1
Opencryptoki implements the PKCS#11 specification v3.0 and partially v3.1, v3.2
for a set of cryptographic hardware, such as IBM 4767, 4768, 4769 and 4770
crypto cards, and the Trusted Platform Module (TPM) chip. Opencryptoki also
brings a software token implementation that can be used without any cryptographic
@ -127,7 +128,7 @@ Requires: %{name}-libs%{?_isa} = %{version}-%{release}
Provides: %{name}(token)
%description icsftok
Opencryptoki implements the PKCS#11 specification v3.0 and partially v3.1
Opencryptoki implements the PKCS#11 specification v3.0 and partially v3.1, v3.2
for a set of cryptographic hardware, such as IBM 4767, 4768, 4769 and 4770
crypto cards, and the Trusted Platform Module (TPM) chip. Opencryptoki also
brings a software token implementation that can be used without any cryptographic
@ -143,7 +144,7 @@ Requires: %{name}-libs%{?_isa} = %{version}-%{release}
Provides: %{name}(token)
%description icatok
Opencryptoki implements the PKCS#11 specification v3.0 and partially v3.1
Opencryptoki implements the PKCS#11 specification v3.0 and partially v3.1, v3.2
for a set of cryptographic hardware, such as IBM 4767, 4768, 4769 and 4770
crypto cards, and the Trusted Platform Module (TPM) chip. Opencryptoki also
brings a software token implementation that can be used without any cryptographic
@ -160,7 +161,7 @@ Requires: %{name}-libs%{?_isa} = %{version}-%{release}
Provides: %{name}(token)
%description ccatok
Opencryptoki implements the PKCS#11 specification v3.0 and partially v3.1
Opencryptoki implements the PKCS#11 specification v3.0 and partially v3.1, v3.2
for a set of cryptographic hardware, such as IBM 4767, 4768, 4769 and 4770
crypto cards, and the Trusted Platform Module (TPM) chip. Opencryptoki also
brings a software token implementation that can be used without any cryptographic
@ -177,7 +178,7 @@ Requires: %{name}-libs%{?_isa} = %{version}-%{release}
Provides: %{name}(token)
%description ep11tok
Opencryptoki implements the PKCS#11 specification v3.0 and partially v3.1
Opencryptoki implements the PKCS#11 specification v3.0 and partially v3.1, v3.2
for a set of cryptographic hardware, such as IBM 4767, 4768, 4769 and 4770
crypto cards, and the Trusted Platform Module (TPM) chip. Opencryptoki also
brings a software token implementation that can be used without any cryptographic
@ -407,6 +408,14 @@ fi
%changelog
* Tue Jul 28 2026 Than Ngo <than@redhat.com> - 3.27.0-1
- Resolves: RHEL-136096, Update to 3.27.0
- Resolves: RHEL-157524, openCryptoki soft token: support PKCS #11 V3.2 ML-DSA and ML-KEM
- Resolves: RHEL-157679, openCryptoki CCA token: support PKCS #11 V3.2 ML-DSA
- Resolves: RHEL-157806, openCryptoki EP11 token: support PKCS #11 V3.2 ML-DSA and ML-KEM
- Resolves: RHEL-169485, openCryptoki: ep11_specific.c syslog warning even for identically configured control points
- Resolves: RHEL-171563, Fix CVE-2026-40253
* Fri Feb 13 2026 Than Ngo <than@redhat.com> - 3.26.0-2
- Resolves: RHEL-144821, CVE-2026-23893

2
sources
View File

@ -1 +1 @@
SHA512 (opencryptoki-3.26.0.tar.gz) = b135139494bfb619de7bb05f0d45f5fa09314405ff21eeacfc55b7fb73b352d7c36328ca85f4efac40e0c346ac9472683348635e6b88262952fdaf9f29664ad2
SHA512 (opencryptoki-3.27.0.tar.gz) = 4574539522efbcca0e836a71b3e0dbbfe56e5959fb94b1d6f7523c27b63ce6fbaae2814422a1aab27c11b283fe035d559747a93f71c8c2531cf396e5803f6447