1223bc4cee
When a process in a guest uses an emulated smartcard, libcacard running on the host passes the PIN from the guest to the PK11_Authenticate NSS function. The first time PK11_Authenticate is called the passed in PIN is used to unlock the certificate database. Subsequent calls to PK11_Authenticate will transparently succeed, regardless of the passed in PIN. This is a convenience for applications provided by NSS. Of course, the guest may have many applications using the one emulated smart card all driven from the same host QEMU process. That means if a user enters the right PIN in one program in the guest, and then enters the wrong PIN in another program in the guest, the wrong PIN will still successfully unlock the virtual smartcard. This commit forces the NSS certificate database to be locked anytime an applet is selected on an emulated smartcard by calling vcard_emul_logout. Signed-off-by: Ray Strode <rstrode@redhat.com> Reviewed-By: Robert Relyea <rrelyea@redhat.com> Reviewed-By: Alon Levy <alevy@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> |
||
---|---|---|
.. | ||
cac.c | ||
cac.h | ||
card_7816.c | ||
card_7816.h | ||
card_7816t.h | ||
event.c | ||
eventt.h | ||
libcacard.pc.in | ||
libcacard.syms | ||
link_test.c | ||
Makefile | ||
vcard_emul_nss.c | ||
vcard_emul_type.c | ||
vcard_emul_type.h | ||
vcard_emul.h | ||
vcard.c | ||
vcard.h | ||
vcardt_internal.h | ||
vcardt.c | ||
vcardt.h | ||
vevent.h | ||
vreader.c | ||
vreader.h | ||
vreadert.h | ||
vscard_common.h | ||
vscclient.c |