add configuration option for PKCS#11 profiles

[ueno]

PKCS#11 3.0 provides a way to claim which profile a token supports (CKO_PROFILE_ID). It would be nice that can be configured through the p11-kit module configuration, such as profile: ....

[ueno]

Here is a use-case.

[ueno]

On second thought, this feature might be infeasible to implement properly, because there will be conflicts of object handles which we create (emulate) and the ones existing on the token. It is possible to maintain a mapping but in that case we need to intercept all the PKCS#11 function calls taking CK_OBJECT_HANDLE, either as a function argument or through mechanism parameters.

Maybe we could support the use-case in a different way, for example, by extending the p11-kit command with sub-commands to add/remove profile objects: p11-kit add-profile --profile public-certificates-token <uri>. Of course this will not work on all modules as some of them may not support creation of CKO_PROFILE_ID objects.

[ZoltanFridrich]

This has already been implemented with add-profile delete-profile and list-profiles commands.
Closing this issue.