Add missing OBJECT_VALIDATION attributes to objects#315
Conversation
f0637de to
8979def
Compare
Cherry-picked from latchset#315 Signed-off-by: Jakub Jelen <jjelen@redhat.com>
simo5
left a comment
There was a problem hiding this comment.
This will cause us to pay the price of key validation on each retrieval ... we may want/need to add some form of caching later...
But otherwise I think this is fine for now.
Signed-off-by: Jakub Jelen <jjelen@redhat.com>
The CKA_OBJECT_VALIDATION_FLAGS was removed from the skip attributes in f541d13 so this block of code did not run since January. Signed-off-by: Jakub Jelen <jjelen@redhat.com>
Signed-off-by: Jakub Jelen <jjelen@redhat.com>
Signed-off-by: Jakub Jelen <jjelen@redhat.com>
Signed-off-by: Jakub Jelen <jjelen@redhat.com>
efba240 to
ef7bffe
Compare
The NSS code had e907d3e which basically considered any key in DB valid. I got to think about that only after implementing this change, but it might be also an option to set this attribute for really everything in the DB. But then we would need to be more precise to make sure we do not let in any non-fips objects :) So feel free to open a separate issue if you have some thoughts about this further. |
Description
The object validation flags were somehow properly checked in the session for the validation state and missing flags on objects were ignored as they were computed on the fly. But these attributes could never make it to the user as even if they would be set during key generation, they were stripped while saving the attributes to the database (and never set for imported keys).
Fixes also bunch of related issues.
Built on top of #314 to have the build working.
Checklist
Reviewer's checklist: