/usr/share/gtk-doc/html/p11-kit/pkcs11-conf.html is in libp11-kit-dev 0.23.2-3.
This file is owned by root:root, with mode 0o644.
The actual contents of the file can be viewed below.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 254 255 256 257 258 259 260 | <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<title>pkcs11.conf: p11-kit</title>
<meta name="generator" content="DocBook XSL Stylesheets V1.78.1">
<link rel="home" href="index.html" title="p11-kit">
<link rel="up" href="tools.html" title="Manual Pages">
<link rel="prev" href="p11-kit.html" title="p11-kit">
<link rel="next" href="trust.html" title="trust">
<meta name="generator" content="GTK-Doc V1.24 (XML mode)">
<link rel="stylesheet" href="style.css" type="text/css">
</head>
<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
<table class="navigation" id="top" width="100%" summary="Navigation header" cellpadding="2" cellspacing="5"><tr valign="middle">
<td width="100%" align="left" class="shortcuts"></td>
<td><a accesskey="h" href="index.html"><img src="home.png" width="16" height="16" border="0" alt="Home"></a></td>
<td><a accesskey="u" href="tools.html"><img src="up.png" width="16" height="16" border="0" alt="Up"></a></td>
<td><a accesskey="p" href="p11-kit.html"><img src="left.png" width="16" height="16" border="0" alt="Prev"></a></td>
<td><a accesskey="n" href="trust.html"><img src="right.png" width="16" height="16" border="0" alt="Next"></a></td>
</tr></table>
<div class="refentry">
<a name="pkcs11-conf"></a><div class="titlepage"></div>
<div class="refnamediv"><table width="100%"><tr>
<td valign="top">
<h2><span class="refentrytitle">pkcs11.conf</span></h2>
<p>pkcs11.conf — Configuration files for PKCS#11 modules</p>
</td>
<td class="gallery_image" valign="top" align="right"></td>
</tr></table></div>
<div class="refsect1">
<a name="pkcs11-conf-description"></a><h2>Description</h2>
<p>The <span class="command"><strong>pkcs11.conf</strong></span> configuration files are a standard
way to configure PKCS#11 modules.</p>
</div>
<div class="refsect1">
<a name="config-format"></a><h2>File format</h2>
<p>A complete configuration consists of several files. These files are
text files. Since <code class="literal">p11-kit</code> is built to be used in all
sorts of environments and at very low levels of the software stack, we
cannot make use of high level configuration APIs that you may find on a
modern desktop.</p>
<p>Each setting in the config file is specified consists of a name and
a value. The name is a simple string consisting of characters and dashes.
The name consists of alpha numeric characters, dot, hyphen and
underscore.</p>
<p>The value is specified after the name on the same line, separated
from it by a <code class="literal">:</code> (colon). White space between the
name and value is ignored.</p>
<p>Blank lines are ignored. White space at the beginning or end of
lines is stripped. Lines that begin with a <code class="literal">#</code> character
are ignored as comments. Comments are not recognized when they come after
a value on a line.</p>
<p>A fictitious module configuration file might look like:</p>
<pre class="programlisting">
module: module.so
# Here is a comment
managed: true
setting.2: A long value with text.
x-custom : text
</pre>
</div>
<div class="refsect1">
<a name="config-module"></a><h2>Module Configuration</h2>
<p>Each configured PKCS#11 module has its own config file. These files
can be <a class="link" href="pkcs11-conf.html#config-locations" title="Configuration Files">placed in various locations</a>.</p>
<p>The filename of the configuration file may consist of upper and lowercase letters
underscore, comma, dash and dots. The first characters needs to be an alphanumeric,
the filename should end with a <code class="literal">.module</code> extension.</p>
<p>Most importantly each config file specifies the path of the PKCS#11 module to
load. A module config file has the following fields:</p>
<div class="variablelist"><table border="0" class="variablelist">
<colgroup>
<col align="left" valign="top">
<col>
</colgroup>
<tbody>
<tr>
<td><p><span class="term"><code class="option">module:</code></span></p></td>
<td>
<p>The filename of the PKCS#11 module to load.
This should include an extension like <code class="literal">.so</code></p>
<p>If this value is blank, then the module will be ignored.
This can be used in the user configs to override loading of a module
specified in the system configuration.</p>
<p>If this is a relative path, then the module will be loaded
from the <a class="link" href="devel-paths.html#devel-paths-modules" title="Default path for modules with relative paths">default module directory</a>.</p>
</td>
</tr>
<tr>
<td><p><span class="term"><code class="option">critical:</code></span></p></td>
<td>
<p>Set to <code class="literal">yes</code> if the module is critical and
required to load. If a critical module fails to load or initialize,
then the loading process for all registered modules will abort and
return an error code.</p>
<p>This argument is optional and defaults to <code class="literal">no</code>.</p>
</td>
</tr>
<tr>
<td><p><span class="term"><code class="option">enable-in:</code></span></p></td>
<td>
<p>A comma and/or space separated list of names of programs that
this module should only be loaded in. The module will not be loaded
for other programs using p11-kit. The base name of the process executable
should be used here, for example
<code class="literal">seahorse, ssh</code>.</p>
<p>This is not a security feature. The argument is optional. If
not present, then any process will load the module.</p>
</td>
</tr>
<tr>
<td><p><span class="term"><code class="option">disable-in:</code></span></p></td>
<td>
<p>A comma and/or space separated list of names of programs that
this module should not be loaded in. The module will be loaded for any
other programs using p11-kit. The base name of the process
executable should be used here, for example
<code class="literal">firefox, thunderbird-bin</code>.</p>
<p>This is not a security feature. The argument is optional. If
not present, then any process will load the module.</p>
</td>
</tr>
<tr>
<td><p><span class="term"><code class="option">managed:</code></span></p></td>
<td>
<p>Set to <code class="literal">no</code> if the module is not to be managed by
p11-kit. Making a module unmanaged is not recommended, and will cause
problems if multiple callers in a single process share a PKCS#11 module.</p>
<p>This argument is optional and defaults to <code class="literal">yes</code>.</p>
</td>
</tr>
<tr>
<td><p><span class="term"><code class="option">priority:</code></span></p></td>
<td>
<p>The value should be an integer. When lists of modules are
returned to a caller of p11-kit, modules with a higher number are sorted
first. When applications search modules for certificates, keys and
trust policy information, this setting will affect what find
first.</p>
<p>This argument is optional, and defaults to zero. Modules
with the same <code class="option">priority</code> option will be sorted
alphabetically.</p>
</td>
</tr>
<tr>
<td><p><a name="option-remote"></a><span class="term"><code class="option">remote:</code></span></p></td>
<td>
<p>Instead of loading the PKCS#11 module locally, run the module
remotely.</p>
<p>Specify a command to run, prefixed with <code class="literal">|</code> a pipe.
The command must speak the p11-kit remoting protocol on its standard in
and standard out. For example:</p>
<pre class="programlisting">
remote: |ssh user@remote p11-kit remote /path/to/module.so
</pre>
<p>Other forms of remoting will appear in later p11-kit releases.</p>
</td>
</tr>
<tr>
<td><p><span class="term"><code class="option">trust-policy:</code></span></p></td>
<td><p>Set to <code class="literal">yes</code> to use use this module as a source
of trust policy information such as certificate anchors and black lists.</p></td>
</tr>
<tr>
<td><p><a name="option-log-calls"></a><span class="term">log-calls:</span></p></td>
<td>
<p>Set to <code class="literal">yes</code> to write a log to stderr of all the
calls into the module. This is only supported for managed modules.</p>
<p>This argument is optional and defaults to <code class="literal">no</code>.</p>
</td>
</tr>
</tbody>
</table></div>
<p>Do not specify both <code class="literal">enable-in</code> and <code class="literal">disable-in</code>
for the same module.</p>
<p>Other fields may be present, but it is recommended that field names
that are not specified in this document start with a <code class="literal">x-</code>
prefix.</p>
</div>
<div class="refsect1">
<a name="config-global"></a><h2>Global Configuration</h2>
<p>A global configuration may also be present. This file contains settings
that are not related to a single PKCS#11 module. The location(s) of the
global configuration are described below. The global configuration file
can contain the following fields:</p>
<div class="variablelist"><table border="0" class="variablelist">
<colgroup>
<col align="left" valign="top">
<col>
</colgroup>
<tbody>
<tr>
<td><p><span class="term"><code class="option">user-config:</code></span></p></td>
<td><p>This will be equal to one of the following values:
<code class="literal">none</code>, <code class="literal">merge</code>,
<code class="literal">only</code>.</p></td>
</tr>
<tr>
<td><p><span class="term"><code class="option">managed:</code></span></p></td>
<td>
<p>Set to <code class="literal">yes</code> or <code class="literal">no</code> to
force all modules to be managed or unmanaged by p11-kit. Setting this
setting in a global configuration file will override the
<code class="literal">managed</code> setting in the individual module configuration
files. Making modules unmanaged is not recommended, and will cause
problems if multiple callers in a single process share a PKCS#11
module.</p>
<p>This argument is optional.</p>
</td>
</tr>
<tr>
<td><p><span class="term">log-calls:</span></p></td>
<td>
<p>Set to <code class="literal">yes</code> to write a log to stderr of all the
calls into all configured modules. This is only supported for managed
modules.</p>
<p>This argument is optional.</p>
</td>
</tr>
</tbody>
</table></div>
<p>Other fields may be present, but it is recommended that field names
that are not specified in this document start with a <code class="literal">x-</code>
prefix.</p>
</div>
<div class="refsect1">
<a name="config-locations"></a><h2>Configuration Files</h2>
<p>Each configured PKCS#11 module is has its own config file. These
files are placed in a directory. In addition a global config file exists.
There is a system configuration consisting of the various module config
files and a file for global configuration. Optionally each user can provide
additional configuration or override the system configuration.</p>
<p>The system global configuration file is usually in
<code class="literal">/etc/pkcs11/pkcs11.conf</code> and the user global
configuration file is in <code class="literal">/data/.config/pkcs11/pkcs11.conf</code> in the
user's home directory.</p>
<p>The module config files are usually located in the
<code class="literal">/etc/pkcs11/modules</code> directory, with one configuration
file per module. In addition the <code class="literal">/data/.config/pkcs11/modules</code> directory
can be used for modules installed by the user.</p>
<p>Note that user configuration files are not loaded from the home
directory if running inside a setuid or setgid program.</p>
<p>The default system config file and module directory can be changed
when building p11-kit. Always
<a class="link" href="devel-paths.html" title="Packaging PKCS#11 module configs">lookup these paths</a> using
<code class="literal">pkg-config</code>.</p>
</div>
<div class="refsect1">
<a name="pkcs11-conf-see-also"></a><h2>See also</h2>
<span class="simplelist"><span class="citerefentry"><span class="refentrytitle">p11-kit</span>(8)</span></span><p>Further details available in the p11-kit online documentation at
<a class="ulink" href="http://p11-glue.freedesktop.org/doc/p11-kit/" target="_top">http://p11-glue.freedesktop.org/doc/p11-kit/</a>.
</p>
</div>
</div>
<div class="footer">
<hr>Generated by GTK-Doc V1.24</div>
</body>
</html>
|