When setting the TRUSTED flag login as security officer.

diff --git a/lib/includes/gnutls/pkcs11.h b/lib/includes/gnutls/pkcs11.h
index 4f2cefd6a43a464cc3f496f4e8afa165a91313d1..c1b79810352b4d19199bf45358f6e4f2b22874e3 100644 (file)
--- a/lib/includes/gnutls/pkcs11.h
+++ b/lib/includes/gnutls/pkcs11.h
@@ -68,6 +68,7 @@ int gnutls_pkcs11_obj_init (gnutls_pkcs11_obj_t * obj);
 #define GNUTLS_PKCS11_OBJ_FLAG_LOGIN (1<<0)     /* force login in the token for the operation */
 #define GNUTLS_PKCS11_OBJ_FLAG_MARK_TRUSTED (1<<1)      /* object marked as trusted */
 #define GNUTLS_PKCS11_OBJ_FLAG_MARK_SENSITIVE (1<<2)    /* object marked as sensitive (unexportable) */
+#define GNUTLS_PKCS11_OBJ_FLAG_LOGIN_SO (1<<3)     /* force login as a security officer in the token for the operation */
 
   /**
    * gnutls_pkcs11_url_type_t:

diff --git a/lib/pkcs11.c b/lib/pkcs11.c
index b07cac94778c16364cd4ea8320c802ac99c23c60..3e030a4338e676e670d1fa6a38482fe01a80ae79 100644 (file)
--- a/lib/pkcs11.c
+++ b/lib/pkcs11.c
@@ -1396,6 +1396,8 @@ pkcs11_obj_flags_to_int (unsigned int flags)
 
   if (flags & GNUTLS_PKCS11_OBJ_FLAG_LOGIN)
     ret_flags |= SESSION_LOGIN;
+  else if (flags & GNUTLS_PKCS11_OBJ_FLAG_LOGIN_SO)
+    ret_flags |= SESSION_LOGIN|SESSION_SO;
 
   return ret_flags;
 }

diff --git a/src/pkcs11.c b/src/pkcs11.c
index 4bb10a682c34323b0bb0f4ea87de89dc4308f586..dafabe3bc2d0016ade2bdcf18ba948a836374551 100644 (file)
--- a/src/pkcs11.c
+++ b/src/pkcs11.c
@@ -145,7 +145,12 @@ pkcs11_list (FILE * outfile, const char *url, int type, unsigned int login,
   unsigned int obj_flags = 0;
 
   if (login)
-    obj_flags = GNUTLS_PKCS11_OBJ_FLAG_LOGIN;
+    {
+      if (type == PKCS11_TYPE_TRUSTED)
+        obj_flags = GNUTLS_PKCS11_OBJ_FLAG_LOGIN_SO;
+      else
+        obj_flags = GNUTLS_PKCS11_OBJ_FLAG_LOGIN;
+    }
 
   pkcs11_common ();