From johnz@domus.sfbay.sun.com Fri Nov 30 12:47:50 2007 Received: from sunmail4.singapore.sun.com (sunmail4.Singapore.Sun.COM [129.158.71.19]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id lAUKlnAf020669 for ; Fri, 30 Nov 2007 12:47:50 -0800 (PST) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail4.singapore.sun.com (8.13.4+Sun/8.13.3/ENSMAIL,v2.2) with ESMTP id lAUKlagv029027 for <@sunmail2sca.sfbay.sun.com:psarc-ext@sun.com>; Sat, 1 Dec 2007 04:47:48 +0800 (SGT) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JSC00K0173MY100@brm-avmta-1.central.sun.com> for psarc-ext@sun.com (ORCPT psarc-ext@sun.com); Fri, 30 Nov 2007 13:47:46 -0700 (MST) Received: from dm-sfbay-02.sfbay.sun.com ([129.146.11.31]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JSC00K1I73MVV00@brm-avmta-1.central.sun.com> for psarc-ext@sun.com (ORCPT psarc-ext@sun.com); Fri, 30 Nov 2007 13:47:46 -0700 (MST) Received: from domus.sfbay.sun.com (domus.SFBay.Sun.COM [10.6.64.11]) by dm-sfbay-02.sfbay.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id lAUKljsN021712 for ; Fri, 30 Nov 2007 12:47:45 -0800 (PST) Received: (from johnz@localhost) by domus.sfbay.sun.com (Trusted Solaris (8.11.7)/8.11.6) id lAUKljs09171; Fri, 30 Nov 2007 12:47:45 -0800 (PST) Date: Fri, 30 Nov 2007 12:47:45 -0800 (PST) From: John Zolnowsky x69422/408-404-5064 Subject: PSARC 2007/674: Enabling Early Signature Validation To: psarc-ext@sun.com Message-id: <200711302047.lAUKljs09171@domus.sfbay.sun.com> Content-transfer-encoding: 7BIT X-Sun-Charset: US-ASCII X-PMX-Version: 5.2.0.264296 Status: RO Content-Length: 3280 I am sponsoring this fast-track for myself. The timer will expire Dec 07, 2007. Summary: This case amends several older cases ([1], [2], [3], [4], [5], [7], [8]) by moving various objects and subdirectories from /usr to /. I am requesting to leave the taxonomy of these objects unchanged, with a patch binding. Problem: The signature validation services required both for the cryptographic framework ([3], [4]) and the planned signed execution project ([6]) at present are restricted to starting after /usr is mounted since several dependent libraries and plugins are in subdirectories of /usr. For cryptographic services, this impedes other services that require cryptographic support early in the lifetime of the system, most obviously network services for the secure mounting of /usr. For signed execution, this increases the number of objects that require special "pre-validation" mechanisms before the signed execution validation service can come online. Proposed Changes: The following table lists the primary objects being moved or created. Any corresponding 64-bit versions, generic symlinks, and lint libraries will be relocated in the same fashion. This list is predicated on the removal of /usr/lib/libcrypto_extra.so.0.9.8 and /usr/lib/libssl_extra.so.0.9.8 by [8]. Note Old Location New Location A /usr/sbin/cryptoadm /sbin/cryptoadm B /lib/crypto /usr/lib/crypto/kcfd /lib/crypto/kcfd C /usr/lib/libcrypto.so.0.9.8 /lib/libcrypto.so.0.9.8 /usr/lib/libcryptoutil.so.1 /lib/libcryptoutil.so.1 /usr/lib/libelfsign.so.1 /lib/libelfsign.so.1 A /usr/lib/libkmf.so.1 /lib/libkmf.so.1 /usr/lib/libkmfberder.so.1 /lib/libkmfberder.so.1 D /usr/lib/security /lib/security /usr/lib/security/kmf_nss.so.1 /lib/security/kmf_nss.so.1 /usr/lib/security/kmf_openssl.so.1 /lib/security/kmf_openssl.so.1 /usr/lib/security/kmf_pkcs11.so.1 /lib/security/kmf_pkcs11.so.1 C /usr/lib/libssl.so.0.9.8 /lib/libssl.so.0.9.8 A /usr/lib/libxml2.so.2 /lib/libxml2.so.2 A /usr/lib/libz.so.1 /lib/libz.so.1 Notes: A Symlinks will refer from the former location of these public objects to their new location. B New directory with Committed name, Volatile contents. C These objects have been approved for relocation from /usr/sfw/lib to /usr/lib by [7]. D This directory becomes the default directory for KMF plugins [9]. Integration Considerations: The list of objects spans multiple prior projects. Since the relocation of these objects are otherwise unrelated, I advise the committee that it is likely that these changes will be integrated over multiple integrations. References: [1] PSARC/1999/555 Getting with the Freeware Program [2] PSARC/2001/175 Using XML and libxml in Solaris [3] PSARC/2001/488 UEF: Userland Encryption Framework [4] PSARC/2003/627 Retail/nonretail status [5] PSARC/2005/074 Solaris Key Management Framework [6] PSARC 2005/295 Barr - Signed Execution [7] PSARC/2006/555 Move OpenSSL to /usr [8] PSARC/2006/610 Data Encryption Kit (SUNWcry) Removal [9] PSARC/2007/604 KMF Pluggability Enhancements From johnz@domus.sfbay.sun.com Mon Dec 10 12:48:50 2007 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id lBAKmnnu005805 for ; Mon, 10 Dec 2007 12:48:50 -0800 (PST) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail5.uk.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id lBAKml2P000120 for <@sunmail2sca.sfbay.sun.com:psarc-ext@Sun.COM>; Mon, 10 Dec 2007 20:48:48 GMT Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JSU00801PTBAJ00@nwk-avmta-2.sfbay.sun.com> for psarc-ext@Sun.COM (ORCPT psarc-ext@Sun.COM); Mon, 10 Dec 2007 12:48:47 -0800 (PST) Received: from dm-sfbay-01.sfbay.sun.com ([129.145.155.118]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JSU003LMPTBZ760@nwk-avmta-2.sfbay.sun.com> for psarc-ext@Sun.COM (ORCPT psarc-ext@Sun.COM); Mon, 10 Dec 2007 12:48:47 -0800 (PST) Received: from domus.sfbay.sun.com (domus.SFBay.Sun.COM [10.6.64.11]) by dm-sfbay-01.sfbay.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id lBAKmkun049394; Mon, 10 Dec 2007 12:48:46 -0800 (PST) Received: (from johnz@localhost) by domus.sfbay.sun.com (Trusted Solaris (8.11.7)/8.11.6) id lBAKmjM05606; Mon, 10 Dec 2007 12:48:45 -0800 (PST) Date: Mon, 10 Dec 2007 12:48:45 -0800 (PST) From: John Zolnowsky x69422/408-404-5064 Subject: Re: PSARC 2007/674: Enabling Early Signature Validation To: psarc-ext@sun.com, John.Zolnowsky@sun.com Message-id: <200712102048.lBAKmjM05606@domus.sfbay.sun.com> Content-transfer-encoding: 7BIT X-Sun-Charset: US-ASCII X-PMX-Version: 5.2.0.264296 Status: RO Content-Length: 94 This fast-track has timed out without comment. I've marked the case closed approved. -JZ