1PKCS11.CONF(5) System Files PKCS11.CONF(5)
2
6 pkcs11.conf - Configuration files for PKCS#11 modules
7
9 The pkcs11.conf configuration files are a standard way to configure
10 PKCS#11 modules.
11
13 A complete configuration consists of several files. These files are
14 text files. Since p11-kit is built to be used in all sorts of
15 environments and at very low levels of the software stack, we cannot
16 make use of high level configuration APIs that you may find on a modern
17 desktop.
18 Each setting in the config file is specified consists of a name and a
20 value. The name is a simple string consisting of characters and dashes.
21 The name consists of alpha numeric characters, dot, hyphen and
22 underscore.
23 The value is specified after the name on the same line, separated from
25 it by a : (colon). White space between the name and value is ignored.
26 Blank lines are ignored. White space at the beginning or end of lines
28 is stripped. Lines that begin with a # character are ignored as
29 comments. Comments are not recognized when they come after a value on a
30 line.
31 A fictitious module configuration file might look like:
33 module: module.so
35 # Here is a comment
36 managed: true
38 setting.2: A long value with text.
39 x-custom : text
40
42 Each configured PKCS#11 module has its own config file. These files can
43 be placed in various locations.
44 The filename of the configuration file may consist of upper and
46 lowercase letters underscore, comma, dash and dots. The first
47 characters needs to be an alphanumeric, the filename should end with a
48 .module extension.
49 Most importantly each config file specifies the path of the PKCS#11
51 module to load. A module config file has the following fields:
52 module:
54 The filename of the PKCS#11 module to load. This should include an
55 extension like .so
56 If this value is blank, then the module will be ignored. This can
58 be used in the user configs to override loading of a module
59 specified in the system configuration.
60 If this is a relative path, then the module will be loaded from the
62 default module directory.
63 critical:
65 Set to yes if the module is critical and required to load. If a
66 critical module fails to load or initialize, then the loading
67 process for all registered modules will abort and return an error
68 code.
69 This argument is optional and defaults to no.
71 enable-in:
73 A comma and/or space separated list of names of programs that this
74 module should only be loaded in. The module will not be loaded for
75 other programs using p11-kit. The base name of the process
76 executable should be used here, for example seahorse, ssh.
77 This is not a security feature. The argument is optional. If not
79 present, then any process will load the module.
80 disable-in:
82 A comma and/or space separated list of names of programs that this
83 module should not be loaded in. The module will be loaded for any
84 other programs using p11-kit. The base name of the process
85 executable should be used here, for example firefox,
86 thunderbird-bin.
87 This is not a security feature. The argument is optional. If not
89 present, then any process will load the module.
90 priority:
92 The value should be an integer. When lists of modules are returned
93 to a caller of p11-kit, modules with a higher number are sorted
94 first. When applications search modules for for certificates, keys
95 and trust policy information, this setting will affect what find
96 first.
97 This argument is optional, and defaults to zero. Modules with the
99 same priority option will be sorted alphabetically.
100 trust-policy:
102 Set to yes to use use this module as a source of trust policy
103 information such as certificate anchors and black lists.
104 Do not specify both enable-in and disable-in for the same module.
106 Other fields may be present, but it is recommended that field names
108 that are not specified in this document start with a x- prefix.
109
111 A global configuration may also be present. This file contains settings
112 that are not related to a single PKCS#11 module. The location(s) of the
113 global configuration are described below. The global configuration file
114 can contain the following fields:
115 user-config:
117 This will be equal to one of the following values: none, merge,
118 only.
119 Other fields may be present, but it is recommended that field names
121 that are not specified in this document start with a x- prefix.
122
124 Each configured PKCS#11 module is has its own config file. These files
125 are placed in a directory. In addition a global config file exists.
126 There is a system configuration consisting of the various module config
127 files and a file for global configuration. Optionally each user can
128 provide additional configuration or override the system configuration.
129 The system global configuration file is usually in
131 /etc/pkcs11/pkcs11.conf and the user global configuration file is in
132 /data/.pkcs11/pkcs11.conf in the user´s home directory.
133 The module config files are usually located in the /etc/pkcs11/modules
135 directory, with one configuration file per module. In addition the
136 /data/.pkcs11/modules directory can be used for modules installed by
137 the user.
138 Note that user configuration files are not loaded from the home
140 directory if running inside a setuid or setgid program.
141 The default system config file and module directory can be changed when
143 building p11-kit. Always lookup these paths using pkg-config.
144
146 p11-kit(8)
147 Further details available in the p11-kit online documentation at
149 http://p11-glue.freedesktop.org/doc/p11-kit/.
150p11-kit PKCS11.CONF(5)