[PATCH v2] OpenSSL: Validate PKCS#11/OpenSC engine and module paths before loading

[Jouni Malinen]

On Tue, Jul 28, 2026 at 07:28:33PM +0800, Tu Naichao wrote:
> The PKCS#11 engine, PKCS#11 module, and OpenSC engine shared object paths
> configured for EAP TLS are passed to OpenSSL, which dlopen()s them within the
> wpa_supplicant/hostapd process. Since these paths can originate from sources
> outside the administrator's direct control (for example the
> SetPKCS11EngineAndModulePath D-Bus method), add an option to validate them
> before loading as a defense-in-depth measure.
> 
> Add a tls_engine_path_trusted() helper that resolves the path with realpath()
> and verifies that the target is a regular file owned by root, not writable by
> group or others, and that every ancestor directory up to the file is itself a
> directory, owned by root and not writable by group or others. lstat() is used
> for the file check so that a symlink is never followed. Any failure is treated
> as untrusted and the load is skipped.
> 
> The enforcement is gated behind a build-time CONFIG_TLS_ENGINE_TRUSTED_PATH
> option (disabled by default) so that it does not affect deployments that run
> wpa_supplicant as a non-root user with shared libraries in a custom directory
> owned by that user.
> 
> Changes in v2: gate the enforcement behind CONFIG_TLS_ENGINE_TRUSTED_PATH
> (default n) based on review feedback that unconditional enforcement could
> break non-root custom-directory deployments.

Thanks, applied.

-- 
Jouni Malinen                                            PGP id EFC895FA