JavaScript is required to for searching.
Skip Navigation Links
Exit Print View
Trusted Extensions Developer's Guide     Oracle Solaris 11.1 Information Library
search filter icon
search icon

Document Information

Preface

1.  Trusted Extensions APIs and Security Policy

Understanding Labels

Label Types

Sensitivity Labels

Clearance Labels

Label Ranges

Label Components

Label Relationships

Trusted Extensions APIs

Label APIs

How Labels Are Used in Access Control Decisions

Types of Label APIs

Sensitivity Label APIs

Clearance Label APIs

Label Range APIs

Trusted X Window System APIs

Trusted Extensions Security Policy

Multilevel Operations

Write-Down Policy in the Global Zone

Default Security Attributes

Default Network Policy

Multilevel Ports

MAC-Exempt Sockets

Zones and Labels

Labels in the Global Zone

Labeled Zones

2.  Labels and Clearances

3.  Label Code Examples

4.  Interprocess Communications

5.  Trusted X Window System

6.  Label Builder GUI

7.  Trusted Web Guard Prototype

8.  Experimental Java Bindings for the Solaris Trusted Extensions Label APIs

A.  Programmer's Reference

B.  Trusted Extensions API Reference

Index

Trusted Extensions APIs

This section introduces the following Trusted Extensions APIs that are described in this book:

In addition to these Trusted Extensions APIs, you can use the security APIs that are available with the Oracle Solaris OS. An application that runs on Trusted Extensions might require the manipulation of other security attributes. For example, the user and profile databases contain information about users, roles, authorizations, and profiles. These databases can restrict who can run a program. Privileges are coded into various Oracle Solaris programs and can also be coded into third-party applications.

For more information about these Oracle Solaris OS security APIs, see Developing Privileged Applications, in Solaris Security for Developers Guide.

The Oracle Solaris OS provides discretionary access control (DAC), in which the owner of the data determines who is permitted access to the data. The Trusted Extensions software provides additional access control, which is called mandatory access control (MAC). In MAC, ordinary users cannot specify or override the security policy. The security administrator sets the security policy.

Applications use Trusted Extensions APIs to obtain labels for hosts, zones, users, and roles. Where the security policy permits, the APIs enable you to set labels on user processes or on role processes. Setting a label on a zone or on a host is an administrative procedure, not a programmatic procedure.

The label APIs operate on opaque labels. In an opaque label, the internal structure of the label is not exposed. Using an opaque label enables existing programs that are created with the APIs to function even if the internal structure of the label changes. For example, you cannot use the label APIs to locate particular bits in a label. The label APIs enable you to obtain labels and to set labels. You can only set labels if you are permitted to do so by the security policy.

Label APIs

Labels, label ranges, and a label limit determine who can access information on a system that is configured with Trusted Extensions.

The label APIs are used to access, convert, and perform comparisons for labels, label ranges and limits, and the relationship between labels. A label can dominate another label, or a label can be disjoint from another label.

The label_encodings file defines the sensitivity labels, clearance labels, label ranges, and label relationships that pertain to your Trusted Extensions environment. This file also controls the appearance of labels. The security administrator is responsible for creating and maintaining the label_encodings file. See the label_encodings(4) man page.

The label of a process is determined by the zone in which the process executes.

All objects are associated with a label or sometimes with a label range. An object can be accessed at a particular label within the defined label range. The objects that are associated with a label range include the following:

For more information about labels, see Label Types.

How Labels Are Used in Access Control Decisions

MAC compares the label of the process that is running an application with the label or the label range of any object that the process tries to access. MAC permits a process to read down to a lower label and permits a process to write to an equal label.

Label[Process] >= Label[Object]

A process bound to a multilevel port (MLP) can listen for requests at multiple labels and send replies to the originator of the request. In Trusted Extensions, such replies are write-equal.

Label[Process] = Label[Object]

Types of Label APIs

Sensitivity Label APIs

Sensitivity label APIs can be used to do the following:

For a description of these APIs, see Chapter 2, Labels and Clearances.

Clearance Label APIs

Users, devices, and network interfaces have label ranges. The upper bound of the range is effectively the clearance. If the upper bound of the range and the lower bound of the range are equal, the range is a single label.

Clearance label APIs can be used to do the following:

For a description of these APIs, see Chapter 2, Labels and Clearances.

Label Range APIs

A label range is used to set limits on the following:

Label ranges are assigned administratively. Label ranges can apply to users, roles, hosts, zones, network interfaces, printers, and other objects.

You can use the following methods to obtain information about label ranges:

For a description of these APIs, see Chapter 2, Labels and Clearances.

Trusted X Window System APIs

The Trusted X Window System, Version 11, server starts at login. The server handles the workstation windowing system by using a trusted interprocess communication (IPC) path. Windows, properties, selections, and ToolTalk sessions are created at multiple sensitivity labels as separate and distinct objects. The creation of distinct objects at multiple sensitivity labels is called polyinstantiation. Applications that are created with Motif widgets, Xt Intrinsics, Xlib, and desktop interfaces run within the constraints of the security policy. These constraints are enforced by extensions to the X11 protocols.

Chapter 5, Trusted X Window System describes the programming interfaces that can access the security attribute information described in Trusted Extensions Security Policy. These programming interfaces can also be used to translate the labels and clearances to text. The text can be constrained by a specified width and font list for display in the Trusted X Window System.

The Trusted X Window System stores the following security attributes:

Audit ID
Trusted Path flag
Group ID
Trusted Path window
Internet address
User ID
Process ID
X Window Server owner ID
Sensitivity label
X Window Server clearance
Session ID
X Window Server minimum label

The Trusted Path flag identifies a window as a Trusted Path window. The Trusted Path window protects the system from being accessed by untrusted programs. This window is always the topmost window, such as the screen stripe or login window.

Appendix B, Trusted Extensions API Reference lists the extensions that you can use to create an X11 trusted IPC path.