Initialize NSS with no DB in the renderer process

base/nss_util.cc

 // Copyright (c) 2010 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "base/nss_util.h"
 #include "base/nss_util_internal.h"
 
 #include <nss.h>
 #include <plarena.h>
 #include <prerror.h>
@@ skipping 186 matching lines @@
       return PK11_ReferenceSlot(real_db_slot_);
     return PK11_GetInternalKeySlot();
   }
 
 #if defined(USE_NSS)
   Lock* write_lock() {
     return &write_lock_;
   }
 #endif  // defined(USE_NSS)
 
+  // This method is used to force NSS to ne initialized without a DB.
+  // Call this method before NSSInitSingleton() is constructed.
+  static void ForceNoDBInit() {
+    force_nodb_init_ = true;
+  }
+
  private:
   friend struct DefaultLazyInstanceTraits<NSSInitSingleton>;
 
   NSSInitSingleton()
       : real_db_slot_(NULL),
         test_db_slot_(NULL),
         root_(NULL),
         chromeos_user_logged_in_(false) {
     EnsureNSPRInit();
 
@@ skipping 12 matching lines @@
       LOG(ERROR) << "NSS_VersionCheck(\"3.12.3\") failed.  "
                     "We depend on NSS >= 3.12.3, and this error is not fatal "
                     "only because many people have busted NSS setups (for "
                     "example, using the wrong version of NSPR). "
                     "Please upgrade to the latest NSS and NSPR, and if you "
                     "still get this error, contact your distribution "
                     "maintainer.";
     }
 
     SECStatus status = SECFailure;
+    bool nodb_init = force_nodb_init_;
+
 #if !defined(USE_NSS)
     // Use the system certificate store, so initialize NSS without database.
-    status = NSS_NoDB_Init(NULL);
-    if (status != SECSuccess) {
-      LOG(ERROR) << "Error initializing NSS without a persistent "
-                    "database: NSS error code " << PR_GetError();
-    }
-#else
-    FilePath database_dir = GetInitialConfigDirectory();
-    if (!database_dir.empty()) {
-      // This duplicates the work which should have been done in
-      // EarlySetupForNSSInit. However, this function is idempotent so there's
-      // no harm done.
-      UseLocalCacheOfNSSDatabaseIfNFS(database_dir);
+    nodb_init = true;
+#endif
 
-      // Initialize with a persistent database (likely, ~/.pki/nssdb).
-      // Use "sql:" which can be shared by multiple processes safely.
-      std::string nss_config_dir =
-          StringPrintf("sql:%s", database_dir.value().c_str());
-#if defined(OS_CHROMEOS)
-      status = NSS_Init(nss_config_dir.c_str());
-#else
-      status = NSS_InitReadWrite(nss_config_dir.c_str());
-#endif
-      if (status != SECSuccess) {
-        LOG(ERROR) << "Error initializing NSS with a persistent "
-                      "database (" << nss_config_dir
-                   << "): NSS error code " << PR_GetError();
-      }
-    }
-    if (status != SECSuccess) {
-      LOG(WARNING) << "Initialize NSS without a persistent database "
-                      "(~/.pki/nssdb).";
+    if (nodb_init) {
       status = NSS_NoDB_Init(NULL);
       if (status != SECSuccess) {
         LOG(ERROR) << "Error initializing NSS without a persistent "
-                      "database: NSS error code " << PR_GetError();
-        return;
+            "database: NSS error code " << PR_GetError();
       }
+    } else {
+      FilePath database_dir = GetInitialConfigDirectory();
+      if (!database_dir.empty()) {
+        // This duplicates the work which should have been done in
+        // EarlySetupForNSSInit. However, this function is idempotent so
+        // there's no harm done.
+        UseLocalCacheOfNSSDatabaseIfNFS(database_dir);
+
+        // Initialize with a persistent database (likely, ~/.pki/nssdb).
+        // Use "sql:" which can be shared by multiple processes safely.
+        std::string nss_config_dir =
+            StringPrintf("sql:%s", database_dir.value().c_str());
+#if defined(OS_CHROMEOS)
+        status = NSS_Init(nss_config_dir.c_str());
+#else
+        status = NSS_InitReadWrite(nss_config_dir.c_str());
+#endif
+        if (status != SECSuccess) {
+          LOG(ERROR) << "Error initializing NSS with a persistent "
+                        "database (" << nss_config_dir
+                     << "): NSS error code " << PR_GetError();
+        }
+      }
+      if (status != SECSuccess) {
+        LOG(WARNING) << "Initialize NSS without a persistent database "
+                        "(~/.pki/nssdb).";
+        status = NSS_NoDB_Init(NULL);
+        if (status != SECSuccess) {
+          LOG(ERROR) << "Error initializing NSS without a persistent "
+              "database: NSS error code " << PR_GetError();
+          return;
+        }
+      }
+
+      PK11_SetPasswordFunc(PKCS11PasswordFunc);
+
+      // If we haven't initialized the password for the NSS databases,
+      // initialize an empty-string password so that we don't need to
+      // log in.
+      PK11SlotInfo* slot = PK11_GetInternalKeySlot();
+      if (slot) {
+        // PK11_InitPin may write to the keyDB, but no other thread can use NSS
+        // yet, so we don't need to lock.
+        if (PK11_NeedUserInit(slot))
+          PK11_InitPin(slot, NULL, NULL);
+        PK11_FreeSlot(slot);
+      }
+
+      root_ = InitDefaultRootCerts();
     }
-
-    PK11_SetPasswordFunc(PKCS11PasswordFunc);
-
-    // If we haven't initialized the password for the NSS databases,
-    // initialize an empty-string password so that we don't need to
-    // log in.
-    PK11SlotInfo* slot = PK11_GetInternalKeySlot();
-    if (slot) {
-      // PK11_InitPin may write to the keyDB, but no other thread can use NSS
-      // yet, so we don't need to lock.
-      if (PK11_NeedUserInit(slot))
-        PK11_InitPin(slot, NULL, NULL);
-      PK11_FreeSlot(slot);
-    }
-
-    root_ = InitDefaultRootCerts();
-#endif  // !defined(USE_NSS)
   }
 
   // NOTE(willchan): We don't actually execute this code since we leak NSS to
   // prevent non-joinable threads from using NSS after it's already been shut
   // down.
   ~NSSInitSingleton() {
     if (real_db_slot_) {
       SECMOD_CloseUserDB(real_db_slot_);
       PK11_FreeSlot(real_db_slot_);
       real_db_slot_ = NULL;
@@ skipping 24 matching lines @@
       if (PK11_NeedUserInit(db_slot))
         PK11_InitPin(db_slot, NULL, NULL);
     }
     else {
       LOG(ERROR) << "Error opening persistent database (" << modspec
                  << "): NSS error code " << PR_GetError();
     }
     return db_slot;
   }
 
+  // If this is set to true NSS is forced to be initialized without a DB.
+  static bool force_nodb_init_;
+
   PK11SlotInfo* real_db_slot_;  // Overrides internal key slot if non-NULL.
   PK11SlotInfo* test_db_slot_;  // Overrides internal key slot and real_db_slot_
   SECMODModule *root_;
   bool chromeos_user_logged_in_;
 #if defined(USE_NSS)
   // TODO(davidben): When https://bugzilla.mozilla.org/show_bug.cgi?id=564011
   // is fixed, we will no longer need the lock.
   Lock write_lock_;
 #endif  // defined(USE_NSS)
 };
 
+bool NSSInitSingleton::force_nodb_init_ = false;
+
 LazyInstance<NSSInitSingleton, LeakyLazyInstanceTraits<NSSInitSingleton> >
     g_nss_singleton(LINKER_INITIALIZED);
 
 }  // namespace
 
 #if defined(USE_NSS)
 void EarlySetupForNSSInit() {
   FilePath database_dir = GetInitialConfigDirectory();
   if (!database_dir.empty())
     UseLocalCacheOfNSSDatabaseIfNFS(database_dir);
 }
 #endif
 
 void EnsureNSPRInit() {
   g_nspr_singleton.Get();
 }
 
 void EnsureNSSInit() {
   // Initializing SSL causes us to do blocking IO.
   // Temporarily allow it until we fix
   //   http://code.google.com/p/chromium/issues/detail?id=59847
   ThreadRestrictions::ScopedAllowIO allow_io;
   g_nss_singleton.Get();
 }
 
+void EnsureNSSNoDBInit() {
+  ThreadRestrictions::ScopedAllowIO allow_io;
+
+  // Force NSS to be initialized without a DB.
+  NSSInitSingleton::ForceNoDBInit();
+  g_nss_singleton.Get();
+}
+
+void DisableNSSForkCheck() {
+  scoped_ptr<Environment> env(Environment::Create());
+  env->SetVar("NSS_STRICT_NOFORK", "DISABLED");
+}
+
 bool CheckNSSVersion(const char* version) {
   return !!NSS_VersionCheck(version);
 }
 
 #if defined(USE_NSS)
 bool OpenTestNSSDB(const FilePath& path, const char* description) {
   return g_nss_singleton.Get().OpenTestNSSDB(path, description);
 }
 
 void CloseTestNSSDB() {
@@ skipping 41 matching lines @@
   exploded.millisecond  = prxtime.tm_usec / 1000;
 
   return Time::FromUTCExploded(exploded);
 }
 
 PK11SlotInfo* GetDefaultNSSKeySlot() {
   return g_nss_singleton.Get().GetDefaultKeySlot();
 }
 
 }  // namespace base