Merge ~3v1n0/ubuntu/+source/sssd:ubuntu/focal into ubuntu/+source/sssd:ubuntu/focal-devel

[Marco Trevisan (Treviño)]

* debian/control:
- Add missing (test) dependencies as per libcrypto usage (LP: #1905790)
- Update Maintainer to Ubuntu devs
* debian/rules: Compile using libcrypto as crypto backend (LP: #1905790)
* debian/nss-database-pem-exporter: Add to sssd-common and run on postinst.
When upgrading from previous versions (that were compiled using the NSS
crypto backend) we need to migrate the trusted CA certificates that the
user may have added to the SSSD's NSS system database (that defaults to
/etc/pki/nssdb).
To do this, and not to introduce a new dependency on libnss3-tools
(which is not shipped by default, other than making the parsing not
working in some scenarios) I've added a small C tool that we compile and
install as part of the sssd-common package which is able to get all the
trusted CA certificates for a NSS database and export them in PEM
format.
The nss-database-pem-exporter is then used in the postinst script where
we now:
    1. Read the SSSD settings
    2. Convert all the certificates in the configured NSS databases
    3. Store them all, appending them to the (new) default location
    (/etc/sssd/pki/sssd_auth_ca_db.pem)
    4. Disables the configured locations if pointing to NSS dbs (needed or
    we'll leave the configuration with broken values).
At this point nss-database-pem-exporter is then the only binary in the
package that still depends on NSS libraries. (LP: #1905790)
* debian/patches:
- Get libsofthsm2 from right path for each architecture, this is now used
    for real (wasn't before) to test p11k components with libcrypto and
    p11-kit, also avoids a test build failure on armhf (LP: #1905790)

[Marco Trevisan (Treviño) (3v1n0)]

A PPA with the built packages is at https://launchpad.net/~ci-train-ppa-service/+archive/ubuntu/4361/+packages

d6e9b9c... by Marco Trevisan (Treviño) on 2020-12-16

debian/patches: Get libsofthsm2 from right path for each architecture

This is now used for real (wasn't before) to test p11k components with
libcrypto and p11-kit

LP: #1905790

e5a94d6... by Marco Trevisan (Treviño) on 2020-12-16

debian/control: Add missing test dependencies as per libcrypto usage

In order to run all the tests with libcrypto we need some more
components to be installed at build time, as some tool that were
provided by NSS are not used anymore.

LP: #1905790

[Sergio Durigan Junior (sergiodj)]

Thanks for the MP, and sorry about the delay in reviewing it.

I have a few minor comments, mostly about the packaging, but otherwise this MP looks fine. I'm not the best person to review the new program you wrote; I looked at it as a C programmer, and it looks OK, but when it comes to a security review I'll defer to xnox.

I'm marking this as Needs Fixing because of the small things I've found/commented on, and because I'm SRUing sssd on Focal (for another, unrelated problem), so you will need to rebase the branch when that is accepted.

review: Needs Fixing

[Marco Trevisan (Treviño) (3v1n0)]

Good, thanks... I've sent my replies.

I noticed you were going to do a new focal release, so fine for me to rebase it.

[Marco Trevisan (Treviño) (3v1n0)]

Ok, I've addressed your comments and rebased...

[Sergio Durigan Junior (sergiodj)]

From my side, everything LGTM (we still need to hear from xnox, I think). Thanks!

review: Approve

[Marco Trevisan (Treviño) (3v1n0)]

I think he approved in chat :)

[18:20] Trevinho: hey [18:20] Trevinho: have you had some time to look at <https://github.com/3v1n0/nss-database-pem-exporter> that is inculde in <https://code.launchpad.net/~3v1n0/ubuntu/+source/sssd/+git/sssd/+merge/395411> ? (edited) [18:27] xnox: I did look at the .c programme [18:27] xnox: It is fine. [18:28] xnox: And packaging looks good too. [20:18] Trevinho: Ok cool, on the c file the only things I was insure was related to trusted flags thing <https://github.com/3v1n0/nss-database-pem-exporter/blob/cafec16fc414945527df6f9a25f77fedeee30485/nss-database-pem-exporter.c#L86> [20:18] Trevinho: Maybe put a line on the LP MR as well as Sergio was wating for your ACK ;) ──────────────────────────────────────────────────────────────────────2021-01-20────────────────────────────────────────
[02:13] xnox: I've seen flags be everything and anything. [02:13] xnox: Many UK passports don't even have valid checksums on their NFC chips so I wouldn't worry about flags 😀 [02:14] xnox: It is a good quick check, as you implemented. [02:15] │ Trevinho: Eheh ok, good then. Thanks for checking!

[Dimitri John Ledkov (xnox)]

Looks good to me!

review: Approve (with logs)

Unmerged commits

7f55160... by Marco Trevisan (Treviño) on 2020-12-16

Update changelog

b8c4d9c... by Marco Trevisan (Treviño) on 2020-12-16

debian/control: Update Maintainer to Ubuntu devs

c16c499... by Marco Trevisan (Treviño) on 2020-12-16

debian: Add nss-database-pem-exporter tool to the package and run it on postinst

When upgrading from previous versions (that were compiled using the NSS
crypto backend) we need to migrate the trusted CA certificates that the
user may have added to the SSSD's NSS system database (that defaults to
/etc/pki/nssdb).

To do this, and not to introduce a new dependency on libnss3-tools
(which is not shipped by default, other than making the parsing not
working in some scenarios) I've added a small C tool that we compile and
install as part of the sssd-common package which is able to get all the
trusted CA certificates for a NSS database and export them in PEM
format.

The nss-database-pem-exporter is then used in the postinst script where
we now:
 1. Read the SSSD settings
 2. Convert all the certificates in the configured NSS databases
 3. Store them all, appending them to the (new) default location
    (/etc/sssd/pki/sssd_auth_ca_db.pem)
 4. Disables the configured locations if pointing to NSS dbs (needed or
    we'll leave the configuration with broken values).

At this point nss-database-pem-exporter is then the only binary in the
package that still depends on NSS libraries.

LP: #1905790

d6e9b9c... by Marco Trevisan (Treviño) on 2020-12-16

debian/patches: Get libsofthsm2 from right path for each architecture

This is now used for real (wasn't before) to test p11k components with
libcrypto and p11-kit

LP: #1905790

e5a94d6... by Marco Trevisan (Treviño) on 2020-12-16

debian/control: Add missing test dependencies as per libcrypto usage

In order to run all the tests with libcrypto we need some more
components to be installed at build time, as some tool that were
provided by NSS are not used anymore.

LP: #1905790

22d3d57... by Marco Trevisan (Treviño) on 2020-12-16

debian/{control,rules}: Compile using libcrypto as crypto backend

LP: #1905790

diff --git a/debian/changelog b/debian/changelog
index b6366f5..95463f8 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,38 @@
+sssd (2.2.3-3ubuntu0.3) UNRELEASED; urgency=medium
+
+  * debian/control:
+    - Add missing (test) dependencies as per libcrypto usage (LP: #1905790)
+    - Update Maintainer to Ubuntu devs
+  * debian/rules: Compile using libcrypto as crypto backend (LP: #1905790)
+  * debian/nss-database-pem-exporter: Add to sssd-common and run on postinst.
+    When upgrading from previous versions (that were compiled using the NSS
+    crypto backend) we need to migrate the trusted CA certificates that the
+    user may have added to the SSSD's NSS system database (that defaults to
+    /etc/pki/nssdb).
+    To do this, and not to introduce a new dependency on libnss3-tools
+    (which is not shipped by default, other than making the parsing not
+    working in some scenarios) I've added a small C tool that we compile and
+    install as part of the sssd-common package which is able to get all the
+    trusted CA certificates for a NSS database and export them in PEM
+    format.
+    The nss-database-pem-exporter is then used in the postinst script where
+    we now:
+     1. Read the SSSD settings
+     2. Convert all the certificates in the configured NSS databases
+     3. Store them all, appending them to the (new) default location
+        (/etc/sssd/pki/sssd_auth_ca_db.pem)
+     4. Disables the configured locations if pointing to NSS dbs (needed or
+        we'll leave the configuration with broken values).
+    At this point nss-database-pem-exporter is then the only binary in the
+    package that still depends on NSS libraries. (LP: #1905790)
+  * debian/patches:
+    - Get libsofthsm2 from right path for each architecture, this is now used
+      for real (wasn't before) to test p11k components with libcrypto and
+      p11-kit, also avoids a test build failure on armhf (LP: #1905790)
+  * Update changelog
+
+ -- Marco Trevisan (Treviño) <[e-mail]>  Tue, 19 Jan 2021 20:05:24 +0100
+
 sssd (2.2.3-3ubuntu0.2) focal; urgency=medium
 
   * d/p/0003-Only-start-sssd.service-if-there-s-a-configuration-f.patch:
diff --git a/debian/control b/debian/control
index 648a240..2180505 100644
--- a/debian/control
+++ b/debian/control
@@ -1,7 +1,8 @@
 Source: sssd
 Section: utils
 Priority: optional
-Maintainer: Debian SSSD Team <[e-mail]>
+Maintainer: Ubuntu Developers <[e-mail]>
+XSBC-Original-Maintainer: Debian SSSD Team <[e-mail]>
 Uploaders: Timo Aaltonen <[e-mail]>,
  Dominik George <[e-mail]>
 Build-Depends:
@@ -15,6 +16,8 @@ Build-Depends:
  docbook-xml,
  docbook-xsl,
  dpkg-dev (>= 1.16.1~),
+ faketime <!nocheck>,
+ gnutls-bin <!nocheck>,
  krb5-config,
  ldap-utils,
  libaugeas-dev,
@@ -38,6 +41,8 @@ Build-Depends:
  libnspr4-dev,
  libnss-wrapper,
  libnss3-dev,
+ libp11-kit-dev,
+ libpam-wrapper <!nocheck>,
  libpam0g-dev | libpam-dev,
  libpcre3-dev,
  libpopt-dev,
@@ -45,6 +50,7 @@ Build-Depends:
  libselinux1-dev [linux-any],
  libsemanage1-dev [linux-any],
  libsmbclient-dev,
+ libssl-dev,
  libsystemd-dev [linux-any],
  libtalloc-dev,
  libtdb-dev,
@@ -52,10 +58,13 @@ Build-Depends:
  libuid-wrapper,
  libxml2-utils,
  lsb-release,
+ openssh-client <!nocheck>,
+ openssl <!nocheck>,
  python3-dev,
  python3-setuptools,
  quilt,
  samba-dev (>= 2:4.1.13),
+ softhsm2 <!nocheck>,
  systemd,
  systemtap-sdt-dev,
  uuid-dev,
diff --git a/debian/nss-database-pem-exporter/README.md b/debian/nss-database-pem-exporter/README.md
 new file mode 100644
index 0000000..919d5cd
--- /dev/null
+++ b/debian/nss-database-pem-exporter/README.md
@@ -0,0 +1,13 @@
+# NSS Database Certificates exporter
+
+A simple tool to export all the trusted CA certificates in a NSS database
+(aka nssdb, usually in `~/.pki/nssdb` or `/etc/pki/nssdb`) as a chained cert
+PEM cert file.
+
+    ./nss-database-pem-exporter > chained-certs.pem
+
+You can verify the parsed content using:
+
+    openssl crl2pkcs7 -nocrl -certfile chained-certs.pem | openssl pkcs7 -print_certs -text -noout
+
+It defaults to `/etc/pki/nssdb`, use `NSS_DATABASE` env variable to override it.
diff --git a/debian/nss-database-pem-exporter/nss-database-pem-exporter.c b/debian/nss-database-pem-exporter/nss-database-pem-exporter.c
 new file mode 100644
index 0000000..e3afebc
--- /dev/null
+++ b/debian/nss-database-pem-exporter/nss-database-pem-exporter.c
@@ -0,0 +1,179 @@
+/*
+ * This file is part of the nss-database-pem-exporter distribution.
+ * Copyright (c) 2020 Marco Trevisan <[e-mail]>.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, version 3.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include <assert.h>
+#include <stdbool.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+#include <nss.h>
+#include <nss/base64.h>
+#include <nss/cert.h>
+#include <nss/certdb.h>
+#include <nss/pk11func.h>
+
+#define NSS_DATABASE_PATH "/etc/pki/nssdb"
+#define OPEN_FLAGS (NSS_INIT_READONLY | NSS_INIT_NOROOTINIT | NSS_INIT_FORCEOPEN)
+
+#define NS_CERT_HEADER "-----BEGIN CERTIFICATE-----"
+#define NS_CERT_TRAILER "-----END CERTIFICATE-----"
+
+static SECStatus
+print_ascii_certificate (CERTCertDBHandle      *handle,
+                         const CERTCertificate *cert)
+{
+  CERTCertList *certs;
+  CERTCertListNode *node;
+
+  certs = CERT_CreateSubjectCertList (NULL, handle, &cert->derSubject,
+                                      PR_Now (), PR_FALSE);
+
+  for (node = CERT_LIST_HEAD (certs); !CERT_LIST_END (node, certs);
+       node = CERT_LIST_NEXT (node))
+    {
+      CERTCertificate *c = node->cert;
+      char *ascii_cert = BTOA_DataToAscii (c->derCert.data, c->derCert.len);
+
+      fprintf (stdout, NS_CERT_HEADER "\n");
+      fprintf (stdout, "%s\n", ascii_cert);
+      fprintf (stdout, NS_CERT_TRAILER "\n");
+
+      free (ascii_cert);
+    }
+
+  if (certs)
+    CERT_DestroyCertList (certs);
+
+  return SECSuccess;
+}
+
+const char *
+get_cert_name (CERTCertListNode *node)
+{
+  CERTCertificate * cert = node->cert;
+  const char *name = node->appData;
+
+  if (name && *name != '\0')
+    return name;
+
+  name = cert->nickname;
+  if (name && *name != '\0')
+    return name;
+
+  name = cert->emailAddr;
+  if (name && *name != '\0')
+    return name;
+
+  return NULL;
+}
+
+bool
+check_trusted_flags (unsigned int flags)
+{
+  if (!(flags & CERTDB_VALID_CA))
+    return false;
+
+  /* Just return true here in any case (to handle the 'c' flag)? */
+  return (flags & (CERTDB_TRUSTED |
+                   CERTDB_TRUSTED_CA |
+                   CERTDB_TRUSTED_CLIENT_CA |
+                   CERTDB_GOVT_APPROVED_CA)) != 0;
+}
+
+bool
+cert_is_trusted (const CERTCertificate *cert)
+{
+  CERTCertTrust *trust = cert->trust;
+
+  if (!trust)
+    return false;
+
+  if (check_trusted_flags (trust->sslFlags))
+    return true;
+
+  if (check_trusted_flags (trust->emailFlags))
+    return true;
+
+  if (check_trusted_flags (trust->objectSigningFlags))
+    return true;
+
+  return false;
+}
+
+static SECStatus
+print_trusted_certificates (CERTCertDBHandle *handle)
+{
+  CERTCertList *list;
+  CERTCertListNode *node;
+
+  list = PK11_ListCerts (PK11CertListCA, NULL);
+  for (node = CERT_LIST_HEAD (list); !CERT_LIST_END (node, list);
+       node = CERT_LIST_NEXT (node))
+    {
+      CERTCertificate *cert = node->cert;
+      const char *cert_name = get_cert_name (node);
+
+      if (!(cert->nsCertType & NS_CERT_TYPE_CA))
+        continue;
+
+      fprintf (stderr, "Found CA certificate %s\n", cert_name);
+      if (!cert)
+        continue;
+
+      if (!cert_is_trusted (cert))
+        {
+          fprintf (stderr, "Certificate %s is not a trusted CA certificate, ignoring\n",
+                   cert_name);
+          continue;
+        }
+
+      print_ascii_certificate (handle, cert);
+    }
+
+  if (list)
+    CERT_DestroyCertList (list);
+  return SECSuccess;
+}
+
+int
+main (void)
+{
+  CERTCertDBHandle *certHandle;
+  const char *nssdb;
+  int exit_status = EXIT_SUCCESS;
+
+  nssdb = getenv ("NSS_DATABASE");
+  if (!nssdb || !*nssdb)
+    nssdb = NSS_DATABASE_PATH;
+
+  if (NSS_Initialize (nssdb, NULL, NULL,
+                      "secmod.db", OPEN_FLAGS) != SECSuccess)
+    {
+      fprintf (stderr, "Failed to open database %s\n", nssdb);
+      return EXIT_FAILURE;
+    }
+
+  certHandle = CERT_GetDefaultCertDB ();
+  if (print_trusted_certificates (certHandle) != SECSuccess)
+    exit_status = EXIT_FAILURE;
+
+  if (NSS_Shutdown () != SECSuccess)
+    return EXIT_FAILURE;
+
+  return exit_status;
+}
diff --git a/debian/patches/series b/debian/patches/series
index 2ec352f..85ab941 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -7,3 +7,4 @@ lp-1868703-02-ad-add-ad_use_ldaps.patch
 lp-1868703-03-ldap-add-new-option-ldap_sasl_maxssf.patch
 lp-1868703-04-ad-set-min-and-max-ssf-for-ldaps.patch
 0003-Only-start-sssd.service-if-there-s-a-configuration-f.patch
+test_ca-Look-for-libsofthsm2-in-libdir-before-falling-bac.patch
diff --git a/debian/patches/test_ca-Look-for-libsofthsm2-in-libdir-before-falling-bac.patch b/debian/patches/test_ca-Look-for-libsofthsm2-in-libdir-before-falling-bac.patch
 new file mode 100644
index 0000000..b28f39d
--- /dev/null
+++ b/debian/patches/test_ca-Look-for-libsofthsm2-in-libdir-before-falling-bac.patch
@@ -0,0 +1,37 @@
+From: Marco Trevisan (Treviño) <[e-mail]>
+Date: Wed, 16 Dec 2020 18:19:00 +0100
+Subject: test_ca: Look for libsofthsm2 in libdir before falling back to
+ hardcoded paths
+
+Right now building SSSD in archs different from amd64 (at least in
+debian and derivatives) won't ever get the test_CA built because
+libsofthsm2 won't be found (leading also to #5397 at times).
+
+As per this, until they won't provide a pkg-config file:
+ - Prioritize looking for libsofthsm2 in configured libdir (will help
+   the developer case when using custom prefixes with custom softhsm2)
+ - Fallback to /usr prefixes, supporting any arch (not only x86_64)
+
+Origin: https://github.com/SSSD/sssd/pull/5438
+Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/sssd/+bug/1905790
+---
+ src/external/test_ca.m4 | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/src/external/test_ca.m4 b/src/external/test_ca.m4
+index 4d45a5a..7f996f3 100644
+--- a/src/external/test_ca.m4
++++ b/src/external/test_ca.m4
+@@ -33,7 +33,11 @@ AC_DEFUN([AM_CHECK_TEST_CA],
+         AM_CONDITIONAL([BUILD_TEST_CA], [test -x "$OPENSSL" -a -x "$SSH_KEYGEN" -a -x "$CERTUTIL" -a -x "$PK12UTIL"])
+     else
+ 
+-        for p in /usr/lib64/pkcs11/libsofthsm2.so /usr/lib/pkcs11/libsofthsm2.so /usr/lib/x86_64-linux-gnu/softhsm/libsofthsm2.so; do
++        for p in  "$(eval echo ${libdir})"/pkcs11/libsofthsm2.so \
++                  "$(eval echo ${libdir})"/softhsm/libsofthsm2.so \
++                  /usr/lib*/pkcs11/libsofthsm2.so \
++                  /usr/lib/*-linux-gnu*/softhsm/libsofthsm2.so \
++                  /usr/lib/softhsm/libsofthsm2.so; do
+             if test -f "${p}"; then
+                 SOFTHSM2_PATH="${p}"
+                 break;
diff --git a/debian/rules b/debian/rules
index b5d46e2..02a0b29 100755
--- a/debian/rules
+++ b/debian/rules
@@ -34,6 +34,7 @@ override_dh_auto_configure:
 	--disable-static \
 	--disable-rpath \
 	--with-autofs \
+	--with-crypto=libcrypto \
 	--with-ssh \
 	--with-initscript=systemd \
 	--with-systemdunitdir=/lib/systemd/system \
@@ -42,6 +43,14 @@ override_dh_auto_configure:
 	--without-python2-bindings \
 	--with-sudo
 
+override_dh_auto_build:
+	dh_auto_build
+
+	mkdir -p $(CURDIR)/debian/build
+	$(CC) $(CURDIR)/debian/nss-database-pem-exporter/nss-database-pem-exporter.c \
+		$(shell pkg-config --cflags --libs nss) -o \
+		$(CURDIR)/debian/build/nss-database-pem-exporter
+
 override_dh_auto_test:
 	export CK_TIMEOUT_MULTIPLIER=10
 	dh_auto_test -- VERBOSE=yes
@@ -50,6 +59,9 @@ override_dh_auto_test:
 override_dh_auto_install:
 	dh_auto_install --max-parallel=1
 
+	install -m755 -D $(CURDIR)/debian/build/nss-database-pem-exporter \
+		-t $(CURDIR)/debian/tmp/usr/libexec/sssd/
+
 override_dh_fixperms:
 	dh_fixperms -Xkrb5_child -Xldap_child -Xselinux_child
 
@@ -102,3 +114,4 @@ override_dh_auto_clean:
 	rm -f $(CURDIR)/src/config/*.pyc
 	rm -f $(CURDIR)/po/stamp-po
 	rm -f $(CURDIR)/src/sbus/codegen/__pycache__/*.pyc
+	rm -rf $(CURDIR)/debian/build
diff --git a/debian/sssd-common.install b/debian/sssd-common.install
index e0f8ad4..fafdab6 100644
--- a/debian/sssd-common.install
+++ b/debian/sssd-common.install
@@ -40,6 +40,7 @@ usr/lib/*/sssd/libsss_util.so
 usr/lib/*/sssd/modules/libsss_autofs.so
 usr/lib/*/sssd/modules/sssd_krb5_localauth_plugin.so
 usr/libexec/sssd/p11_child
+usr/libexec/sssd/nss-database-pem-exporter
 usr/libexec/sssd/sss_signal
 usr/libexec/sssd/sssd_autofs
 usr/libexec/sssd/sssd_be
diff --git a/debian/sssd-common.postinst b/debian/sssd-common.postinst
index 295d6a2..ff8d3ee 100644
--- a/debian/sssd-common.postinst
+++ b/debian/sssd-common.postinst
@@ -20,6 +20,48 @@ set -e
 OUT=/dev/null
 HOME=/var/lib/sss
 LIBDIR=/usr/libexec/sssd
+CA_CERTS_NSSDB=/etc/pki/nssdb
+CA_CERTS_CHAIN=/etc/sssd/pki/sssd_auth_ca_db.pem
+
+get_config_value()
+{
+    if [ ! -f /etc/sssd/sssd.conf ]; then
+        return 0
+    fi
+
+    awk -F '=' '{if (! ($0 ~ /^;/) && ! ($0 ~ /^#/) && $0 ~ /'"$1"'/) print $2}' \
+        /etc/sssd/sssd.conf | tr -d ' ' | tail -n1
+}
+
+is_pem_file()
+{
+    [ -f "$1" ] && \
+        grep -qsI -- "-----BEGIN CERTIFICATE-----" "$1" && \
+        grep -qsI -- "-----END CERTIFICATE-----" "$1"
+}
+
+import_nss_ca_certs()
+{
+    nssdb="$1"
+
+    if [ -z "$nssdb" ]; then
+        return
+    fi
+
+    if is_pem_file "$nssdb"; then
+        return 1
+    fi
+
+    echo "Importing $nssdb CA certificates to $CA_CERTS_CHAIN"
+    env NSS_DATABASE="$nssdb" \
+        $LIBDIR/nss-database-pem-exporter >> "$CA_CERTS_CHAIN"
+}
+
+disable_setting()
+{
+    echo "Disabling sssd.conf setting using invalid value: '$1'"
+    sed -i 's/^[^#;]*'"$1"'\b/#&/' /etc/sssd/sssd.conf || true
+}
 
 case "$1" in
     configure)
@@ -41,6 +83,7 @@ case "$1" in
             /etc/sssd \
             /var/log/sssd
         chown root:sssd $LIBDIR/p11_child
+        chown root:sssd $LIBDIR/nss-database-pem-exporter
 
         chmod 4754 $LIBDIR/p11_child
         chmod 755 $HOME/gpo_cache $HOME/mc $HOME/pipes $HOME/pubconf
@@ -52,6 +95,31 @@ case "$1" in
             chown root:root /etc/sssd/sssd.conf
             chmod 0600 /etc/sssd/sssd.conf
         fi
+
+        if dpkg --compare-versions "$2" lt-nl 2.2.3-3ubuntu0.2; then
+            # When upgrading (only), we may need to migrate the NSS
+            # database entries
+            ca_db=$(get_config_value ca_db)
+            pam_cert_db_path=$(get_config_value pam_cert_db_path)
+
+            mkdir -p -m711 "$(dirname "$CA_CERTS_CHAIN")"
+
+            nss_db="$ca_db"
+            if [ -z "$nss_db" ] && [ -d "$CA_CERTS_NSSDB" ]; then
+                nss_db="$CA_CERTS_NSSDB"
+            fi
+
+            if import_nss_ca_certs "$nss_db"; then
+                [ "$nss_db" = "$ca_db" ] && \
+                    disable_setting 'ca_db'
+            fi
+
+            if [ "$pam_cert_db_path" != "$nss_db" ]; then
+                if import_nss_ca_certs "$pam_cert_db_path"; then
+                    disable_setting 'pam_cert_db_path'
+                fi
+            fi
+        fi
     ;;
 
     abort-upgrade|abort-remove|abort-deconfigure)