Blame SOURCES/nss-modutil-skip-changepw-fips.patch
|
 |
c70942 |
# HG changeset patch
|
|
|
c70942 |
# User Daiki Ueno <dueno@redhat.com>
|
|
|
c70942 |
# Date 1523546409 -7200
|
|
|
c70942 |
# Thu Apr 12 17:20:09 2018 +0200
|
|
|
c70942 |
# Node ID 919e116728f29263c17ec31716ac2bd04c10e9ca
|
|
|
c70942 |
# Parent 2eefd697d661efb82a77c84d893e6fbceefdf458
|
|
|
c70942 |
Bug 1453408, modutil -changepw fails in FIPS mode if password is an empty string
|
|
|
c70942 |
|
|
|
c70942 |
diff --git a/cmd/modutil/pk11.c b/cmd/modutil/pk11.c
|
|
|
c70942 |
--- a/cmd/modutil/pk11.c
|
|
|
c70942 |
+++ b/cmd/modutil/pk11.c
|
|
|
c70942 |
@@ -764,6 +764,10 @@ ChangePW(char *tokenName, char *pwFile,
|
|
|
c70942 |
ret = CHANGEPW_FAILED_ERR;
|
|
|
c70942 |
goto loser;
|
|
|
c70942 |
}
|
|
|
c70942 |
+ } else if (PK11_IsFIPS() && *newpw == '\0' && PK11_CheckUserPassword(slot, newpw) == SECSuccess) {
|
|
|
c70942 |
+ /* Workaround to suppress harmless error in FIPS mode:
|
|
|
c70942 |
+ * When explicitly setting empty password while the old
|
|
|
c70942 |
+ * password is also empty, skip */
|
|
|
c70942 |
} else {
|
|
|
c70942 |
if (PK11_ChangePW(slot, oldpw, newpw) != SECSuccess) {
|
|
|
c70942 |
PR_fprintf(PR_STDERR, errStrings[CHANGEPW_FAILED_ERR], tokenName);
|