1PKCS11.CONF(5)                   System Files                   PKCS11.CONF(5)
2
3
4

NAME

6       pkcs11.conf - Configuration files for PKCS#11 modules
7

DESCRIPTION

9       The pkcs11.conf configuration files are a standard way to configure
10       PKCS#11 modules.
11

FILE FORMAT

13       A complete configuration consists of several files. These files are
14       text files. Since p11-kit is built to be used in all sorts of
15       environments and at very low levels of the software stack, we cannot
16       make use of high level configuration APIs that you may find on a modern
17       desktop.
18
19       Each setting in the config file is specified consists of a name and a
20       value. The name is a simple string consisting of characters and dashes.
21       The name consists of alpha numeric characters, dot, hyphen and
22       underscore.
23
24       The value is specified after the name on the same line, separated from
25       it by a : (colon). White space between the name and value is ignored.
26
27       Blank lines are ignored. White space at the beginning or end of lines
28       is stripped. Lines that begin with a # character are ignored as
29       comments. Comments are not recognized when they come after a value on a
30       line.
31
32       A fictitious module configuration file might look like:
33
34           module: module.so
35           # Here is a comment
36
37           managed: true
38           setting.2: A long value with text.
39           x-custom : text
40

MODULE CONFIGURATION

42       Each configured PKCS#11 module has its own config file. These files can
43       be placed in various locations.
44
45       The filename of the configuration file may consist of upper and
46       lowercase letters underscore, comma, dash and dots. The first
47       characters needs to be an alphanumeric, the filename should end with a
48       .module extension.
49
50       Most importantly each config file specifies the path of the PKCS#11
51       module to load. A module config file has the following fields:
52
53       module:
54           The filename of the PKCS#11 module to load. This should include an
55           extension like .so
56
57           If this value is blank, then the module will be ignored. This can
58           be used in the user configs to override loading of a module
59           specified in the system configuration.
60
61           If this is a relative path, then the module will be loaded from the
62           default module directory.
63
64       critical:
65           Set to yes if the module is critical and required to load. If a
66           critical module fails to load or initialize, then the loading
67           process for all registered modules will abort and return an error
68           code.
69
70           This argument is optional and defaults to no.
71
72       enable-in:
73           A comma and/or space separated list of names of programs that this
74           module should only be loaded in. The module will not be loaded for
75           other programs using p11-kit. The base name of the process
76           executable should be used here, for example seahorse, ssh.
77
78           This option can also be used to control whether the module will be
79           loaded by the proxy module. To enable loading only from the proxy
80           module, specify p11-kit-proxy as the value.
81
82           This is not a security feature. The argument is optional. If not
83           present, then any process will load the module.
84
85       disable-in:
86           A comma and/or space separated list of names of programs that this
87           module should not be loaded in. The module will be loaded for any
88           other programs using p11-kit. The base name of the process
89           executable should be used here, for example firefox,
90           thunderbird-bin.
91
92           This option can also be used to control whether the module will be
93           loaded by the proxy module. To disable loading from the proxy
94           module, specify p11-kit-proxy as the value.
95
96           This is not a security feature. The argument is optional. If not
97           present, then any process will load the module.
98
99       managed:
100           Set to no if the module is not to be managed by p11-kit. Making a
101           module unmanaged is not recommended, and will cause problems if
102           multiple callers in a single process share a PKCS#11 module.
103
104           This argument is optional and defaults to yes.
105
106       priority:
107           The value should be an integer. When lists of modules are returned
108           to a caller of p11-kit, modules with a higher number are sorted
109           first. When applications search modules for certificates, keys and
110           trust policy information, this setting will affect what find first.
111
112           This argument is optional, and defaults to zero. Modules with the
113           same priority option will be sorted alphabetically.
114
115       remote:
116           Instead of loading the PKCS#11 module locally, run the module
117           remotely.
118
119           Specify a command to run, prefixed with | a pipe. The command must
120           speak the p11-kit remoting protocol on its standard in and standard
121           out. For example:
122
123               remote: |ssh user@remote p11-kit remote /path/to/module.so
124
125           Other forms of remoting will appear in later p11-kit releases.
126
127       trust-policy:
128           Set to yes to use use this module as a source of trust policy
129           information such as certificate anchors and black lists.
130
131       log-calls:
132           Set to yes to write a log to stderr of all the calls into the
133           module. This is only supported for managed modules.
134
135           This argument is optional and defaults to no.
136
137       Do not specify both enable-in and disable-in for the same module.
138
139       Other fields may be present, but it is recommended that field names
140       that are not specified in this document start with a x- prefix.
141

GLOBAL CONFIGURATION

143       A global configuration may also be present. This file contains settings
144       that are not related to a single PKCS#11 module. The location(s) of the
145       global configuration are described below. The global configuration file
146       can contain the following fields:
147
148       user-config:
149           This will be equal to one of the following values: none, merge,
150           only.
151
152       managed:
153           Set to yes or no to force all modules to be managed or unmanaged by
154           p11-kit. Setting this setting in a global configuration file will
155           override the managed setting in the individual module configuration
156           files. Making modules unmanaged is not recommended, and will cause
157           problems if multiple callers in a single process share a PKCS#11
158           module.
159
160           This argument is optional.
161
162       log-calls:
163           Set to yes to write a log to stderr of all the calls into all
164           configured modules. This is only supported for managed modules.
165
166           This argument is optional.
167
168       Other fields may be present, but it is recommended that field names
169       that are not specified in this document start with a x- prefix.
170

CONFIGURATION FILES

172       Each configured PKCS#11 module has its own config file. These files are
173       placed in a directory. In addition a global config file exists. There
174       is a system configuration consisting of the various module config files
175       and a file for global configuration. Optionally each user can provide
176       additional configuration or override the system configuration.
177
178       The system global configuration file is usually in
179       /etc/pkcs11/pkcs11.conf and the user global configuration file is in
180       ~/.config/pkcs11/pkcs11.conf in the user's home directory.
181
182       The module config files are usually located in the /etc/pkcs11/modules
183       directory, with one configuration file per module. In addition the
184       ~/.config/pkcs11/modules directory can be used for modules installed by
185       the user.
186
187       Note that user configuration files are not loaded from the home
188       directory if running inside a setuid or setgid program.
189
190       The default system config file and module directory can be changed when
191       building p11-kit. Always lookup these paths using pkg-config.
192

SEE ALSO

194       p11-kit(8)
195
196       Further details available in the p11-kit online documentation at
197       https://p11-glue.github.io/p11-glue/p11-kit/manual/.
198
199
200
201p11-kit                                                         PKCS11.CONF(5)
Impressum