Encrypt SQLite databases from mozStorageService by Not-Nik · Pull Request #173 · mozilla/enterprise-firefox

Not-Nik · 2025-11-20T13:07:31Z

Encrypt SQLite database whose connections are created in mozStorageService. Cloned and ATTACHed connections are also affected. The mechanism is behind a new security.storage.keystore.enabled. The keys for the connections are stored, encrypted by the SDR, in a new bikeshed/keystore.enc.

security/keystore/KeyStorage.cpp

gcp · 2025-11-20T14:26:48Z

security/keystore/KeyStorage.cpp

+}
+
+nsresult GetKeyForFile(nsIFile* aFile, nsCString& keyString) {
+  nsAutoCString telemetryFilename;


Weird naming here.

security/keystore/KeyStorage.cpp

security/keystore/Persist.cpp

security/keystore/KeyStorage.sys.mjs

security/keystore/Persist.cpp

storage/mozStorageConnection.cpp

security/keystore/KeyStorage.cpp

gcp · 2025-11-21T17:06:03Z

I think this wants tests as well. For Foxfooding we can deal with some flakyness but causing all SQLite databases to get corrupted will probably get old soon for the poor testers 😄

mozkeeler · 2026-01-13T17:31:20Z

security/keystore/Persist.cpp

+    // PK11SDR_Encrypt will allocate the needed buffer in SECItem
+    encryptedKey.reset(new SECItem());
+
+    stat = PK11SDR_Encrypt(&keyid, key.get(), encryptedKey.get(), nullptr);


This uses 3DES. You want PK11SDR_EncryptWithMechanism.

mozkeeler · 2026-01-13T17:34:56Z

security/keystore/KeyStorage.cpp

Is there a particular reason to have this in its own directory? These kinds of files tend to belong in security/manager (or at least a subdirectory therein).

I think the key management component will be more visible one ladder up in its own directory. Also it is neither PKI or TLS specific, so I would prefer to keep it there for now... : )

mozkeeler · 2026-01-13T17:37:43Z

security/keystore/Persist.cpp

+    mozilla::UniqueSECItem key = mozilla::UniqueSECItem(new SECItem());
+    SECStatus stat = SECITEM_MakeItem(nullptr, key.get(),
+                                      (unsigned char*)encryptedKey.Data(),
+                                      encryptedKey.Length());


Generally speaking, you probably don't need to do the whole new SECItem() ... SECITEM_MakeItem(...) - you can do something like SECItem key = { siBuffer, (unsigned char*)encryptedKey.Data(), encryptedKey.Length() }; (assuming the NSS functions you call either copy the data or only borrow it for the length of the call, which is most of them).

That particular example needs a "proper" SECItem (on the heap), because it is later stored in KEY_MAP, which is static and thus outlives encryptedKey. I already tried to reduce buffer allocation, and I'll move to a stack SECItem in the path == SYSTEM_KEY_NAME path, but if I missed anything else do let me know.

mozkeeler · 2026-01-13T17:40:48Z

security/keystore/Persist.cpp

Some of this code seems very similar to NSSKeyStore - is there a reason to not re-use that? (currently it's only used as a fallback on Linux, but you could use it unconditionally here)

For one the custom solution allows us some flexibility right away, only requiring the token to be unlocked once for loading all the keys. Later database open operations can then rely on the master key to do their work (create new key, decrypt existing key). Additionally, there is a plan to turn the keystore into the lockstore module which Benjamin has been working on.

Not-Nik

Several notes from Benjamin and me

storage/mozStorageService.cpp

storage/mozStorageConnection.cpp

Not-Nik · 2026-01-20T11:17:56Z

storage/mozStorageConnection.cpp

Document why there is a new function, instead of just a boolean passed to initialize and why this doesn't use "readonly-immutable-nolock".

storage/mozStorageConnection.cpp

security/keystore/Persist.cpp

modules/libpref/Preferences.cpp

storage/mozStorageConnection.cpp

modules/libpref/init/StaticPrefList.yaml

security/keystore/KeyStorage.cpp

security/keystore/Persist.cpp

security/keystore/KeyStorage.cpp

gcp · 2026-02-05T22:19:37Z

security/keystore/Persist.cpp

Running in debug mode will answer this question: https://searchfox.org/firefox-main/rev/286e75a82e5c489d020d18121674809ebf114ae4/xpcom/io/nsDirectoryService.cpp#184 😀 😀 😀 😀

storage/mozStorageConnection.cpp

…elativePath(). r=nika Differential Revision: https://phabricator.services.mozilla.com/D285766

Differential Revision: https://phabricator.services.mozilla.com/D270165

Not-Nik temporarily deployed to Credentials November 20, 2025 13:07 — with GitHub Actions Inactive

Not-Nik temporarily deployed to Credentials November 20, 2025 13:20 — with GitHub Actions Inactive

Not-Nik temporarily deployed to Credentials November 20, 2025 13:22 — with GitHub Actions Inactive

Not-Nik temporarily deployed to Credentials November 20, 2025 13:23 — with GitHub Actions Inactive

Not-Nik temporarily deployed to Credentials November 20, 2025 13:25 — with GitHub Actions Inactive

Not-Nik temporarily deployed to Credentials November 20, 2025 13:29 — with GitHub Actions Inactive

gcp requested changes Nov 21, 2025

View reviewed changes

Not-Nik marked this pull request as draft December 4, 2025 16:39

Not-Nik force-pushed the sqlite-encryption branch from 4366c03 to 6c41571 Compare December 4, 2025 16:40

Not-Nik temporarily deployed to Credentials December 4, 2025 16:40 — with GitHub Actions Inactive

Not-Nik temporarily deployed to Credentials December 4, 2025 16:47 — with GitHub Actions Inactive

Not-Nik temporarily deployed to Credentials December 4, 2025 16:48 — with GitHub Actions Inactive

Not-Nik temporarily deployed to Credentials December 4, 2025 17:03 — with GitHub Actions Inactive

Not-Nik temporarily deployed to Credentials December 4, 2025 17:06 — with GitHub Actions Inactive

Not-Nik force-pushed the sqlite-encryption branch from 6c41571 to 904029f Compare December 11, 2025 13:29

Not-Nik temporarily deployed to Credentials December 11, 2025 13:29 — with GitHub Actions Inactive

Not-Nik temporarily deployed to Credentials December 11, 2025 13:35 — with GitHub Actions Inactive

Not-Nik temporarily deployed to Credentials December 16, 2025 12:50 — with GitHub Actions Inactive

Not-Nik temporarily deployed to Credentials December 16, 2025 12:55 — with GitHub Actions Inactive

Not-Nik force-pushed the sqlite-encryption branch from 8afd65b to a0458b4 Compare January 13, 2026 17:12

mozkeeler reviewed Jan 13, 2026

View reviewed changes

Not-Nik force-pushed the sqlite-encryption branch 2 times, most recently from 788f472 to 1190b4e Compare January 15, 2026 17:43

Not-Nik requested a review from gcp January 15, 2026 17:47

Not-Nik commented Jan 20, 2026

View reviewed changes

Not-Nik force-pushed the sqlite-encryption branch 3 times, most recently from 1d06ea2 to a5f339a Compare February 2, 2026 11:04

beurdouche mentioned this pull request Feb 2, 2026

Lockstore storage module and IPC support #392

Draft

Not-Nik force-pushed the sqlite-encryption branch 3 times, most recently from bf5365c to 175aeb6 Compare February 5, 2026 09:24

Not-Nik commented Feb 5, 2026

View reviewed changes

modules/libpref/Preferences.cpp Outdated Show resolved Hide resolved

gcp requested changes Feb 5, 2026

View reviewed changes

Not-Nik force-pushed the sqlite-encryption branch 10 times, most recently from ca4be9c to aabfe45 Compare February 20, 2026 21:39

Not-Nik added 2 commits March 4, 2026 14:54

Bug 2020620 - Ignore device path specifier in nsLocalFileCommon::GetR…

a7e6ba9

…elativePath(). r=nika Differential Revision: https://phabricator.services.mozilla.com/D285766

Bug 1996558 - Encrypt SQLite databases from mozStorageService

adc3b8d

Differential Revision: https://phabricator.services.mozilla.com/D270165

Not-Nik force-pushed the sqlite-encryption branch from aabfe45 to adc3b8d Compare March 4, 2026 13:55

Conversation

Not-Nik commented Nov 20, 2025

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

gcp commented Nov 21, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Not-Nik left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Not-Nik left a comment •

edited

Loading