System Management Guide: Operating System and Devices

PKCS #11 Usage

Note: The information in this section is specific to POWER-based.

For an application to use the PKCS #11 subsystem, the subsystem's slot manager daemon must be running and the application must load in the API's shared object.

The slot manager is normally started at boot time by inittab calling the /etc/rc.pkcs11 script. This script verifies the adapters in the system before starting the slot manager daemon. As a result, the slot manager daemon is not available before the user logs on to the system. After the daemon starts, the subsystem incorporates any changes to the number and types of supported adapters without intervention from the systems administrator.

The API can be loaded either by linking in the object at runtime or by using deferred symbol resolution. For example, an application can get the PKCS #11 function list in the following manner:

d CK_RV (*pf_init)();
void *d;
CK_FUNCTION_LIST *functs;
 
d = dlopen(e, RTLD_NOW);
if ( d == NULL ) {
   return FALSE;
}
 
pfoo = (CK_RV (*)())dlsym(d, "C_GetFunctionList");
if (pfoo == NULL) {
   return FALSE;
}
 
rc = pf_init(&functs);