b=143532 Only allow toggling FIPS when it is safe to

r=javi sr=alecf

security/manager/pki/resources/content/device_manager.js

@@ -80,10 +80,10 @@ function LoadModules()
     } catch (e) { done = true; }
   }
   /* Set the text on the fips button */
-  SetFIPSButtonText();
+  SetFIPSButton();
 }
 
-function SetFIPSButtonText()
+function SetFIPSButton()
 {
   var fipsButton = document.getElementById("fipsbutton");
   var label;
@@ -93,6 +93,13 @@ function SetFIPSButtonText()
    label = bundle.GetStringFromName("enable_fips"); 
   }
   fipsButton.setAttribute("label", label);
+
+  var can_toggle = secmoddb.canToggleFIPS;
+  if (can_toggle) {
+    fipsButton.removeAttribute("disabled");
+  } else {
+    fipsButton.setAttribute("disabled", "true");
+  }
 }
 
 /* Add a module to the tree.  slots is the array of slots in the module,

security/manager/ssl/public/nsIPKCS11Slot.idl

@@ -96,6 +96,8 @@ interface nsIPKCS11ModuleDB : nsISupports
 
   nsIEnumerator listModules();
 
+  readonly attribute boolean canToggleFIPS;
+
   void toggleFIPSMode();
 
   readonly attribute boolean isFIPSEnabled;

security/manager/ssl/src/nsPKCS11Slot.cpp

@@ -375,6 +375,13 @@ nsPKCS11ModuleDB::ListModules(nsIEnumerator **_retval)
   return rv;
 }
 
+NS_IMETHODIMP nsPKCS11ModuleDB::GetCanToggleFIPS(PRBool *aCanToggleFIPS)
+{
+  *aCanToggleFIPS = SECMOD_CanDeleteInternalModule();
+  return NS_OK;
+}
+
+
 /* void toggleFIPSMode (); */
 NS_IMETHODIMP nsPKCS11ModuleDB::ToggleFIPSMode()
 {