entd: Cope with timeout during user pin initialization

bin/fix_pkcs11_token.sh

 #!/bin/sh
 
 if [ -z "$1" ]; then
   USERNAME="chronos"
 else
   USERNAME="$1"
 fi
 
 PKCS11_GROUP="pkcs11"
 
 OPENCRYPTOKI_DIR="/var/lib/opencryptoki"
 USER_TOKEN_LINK="$OPENCRYPTOKI_DIR/tpm/$USERNAME"
 ROOT_TOKEN_LINK="$OPENCRYPTOKI_DIR/tpm/root"
 
 USER_TOKEN_DIR="/home/$USERNAME/user/.tpm"
 
-if [ -e "$USER_TOKEN_DIR/PUBLIC_ROOT_KEY.pem" -a \
-  ! -e "$USER_TOKEN_DIR/PRIVATE_ROOT_KEY.pem" ]; then
-  # A token with a public key but no private key is a sign that
-  # initialization timed out.  The only way to recover seems to be to wipe
-  # out the whole token and try again.
-  logger "PKCS#11 token appears to be broken, deleting: $USER_TOKEN_DIR/*"
-  rm -rf "$USER_TOKEN_DIR"/*
+log() {
+  if [ -t 1 ]; then
+    echo "$@" 1>&2
+  else
+    logger -t $(basename "$0") "$@"
+  fi
+}
+
+if [ ! -f "$USER_TOKEN_DIR/PUBLIC_ROOT_KEY.pem" ]; then
+  log "No PKCS#11 token found for $USERNAME."
+else
+  if [ -e "$USER_TOKEN_DIR/PRIVATE_ROOT_KEY.pem" -a \
+    -e "$USER_TOKEN_DIR/TOK_OBJ/70000000" ]; then

[Chris Masone, 2010/08/25 00:33:13]

-f or -e, be consistent.

+    log "PKCS#11 token for $USERNAME looks ok."
+  else
+    # If these files are missing, it's a sign that initialization timed out.
+    # The only way to recover seems to be to wipe out the whole token and try
+    # again.
+    log "PKCS#11 token for $USERNAME appears to be broken, deleting:" \
+      "$USER_TOKEN_DIR/*"
+    rm -rf "$USER_TOKEN_DIR"/*
+  fi
 fi
 
 # Ensure the directories exist
 mkdir -p "$OPENCRYPTOKI_DIR/tpm"
 chown -R "root:$PKCS11_GROUP" "$OPENCRYPTOKI_DIR"
 
 # Ensure that they point to the user volume
 [ -L "$USER_TOKEN_LINK" ] || \
   ln -sf "$USER_TOKEN_DIR" "$USER_TOKEN_LINK"
 [ -L "$ROOT_TOKEN_LINK" ] || \
   ln -sf "./$USERNAME" "$ROOT_TOKEN_LINK"
 
 # Always remove the old token entry.
 rm -f /var/lib/opencryptoki/pk_config_data
 
 # Creating this directory because if it's not there, token initialization
 # will neither create it nor populate it.
 mkdir -p "$USER_TOKEN_DIR/TOK_OBJ"
 
 # Configure the tpm as a token
 pkcs_slot 0 tpm
 
 # Make sure the user can access their own data
 chown -R "$USERNAME:$PKCS11_GROUP" "$USER_TOKEN_DIR"