Trusted Solaris Administrator's Procedures

Security Attributes on File Systems

File systems supported by Trusted Solaris software are characterized by whether their attributes can be changed or not. When the attributes can be changed, they are called variable attribute or variable file systems. File systems that do not support Trusted Solaris extended security attributes are called fixed because any attributes assigned to them (either at mount time or by default) cannot be altered.

Following are more details relevant for understanding and managing the various types of variable and fixed file system types:

All ufs-type file systems are variable and therefore, all file systems installed with the Trusted Solaris software are variable.

For example, if you connect a hard disk containing an unlabeled file system directly to a Trusted Solaris computer, when the file system is ufs-mounted the unlabeled file system becomes a variable file system, with a default set of attributes shown in Table 9-2.
An nfs-type file system mounted from a Trusted Solaris or TSIX NFS server is variable.
An nfs-type file system mounted from an NFS server running another operating environment is fixed.
tmpfs file systems are variable.
These file system types are always fixed: fdfs, hsfs, pcfs.
The lofs-type file system's attributes are those of the underlying file system. See "Mounting File Systems in the Trusted Solaris Environment" for more information.

The following table shows the security attributes for variable-attribute file systems, with the default values that are used when none are specified.

Table 9-2 Variable File System Security Attributes with Defined Settings


Attribute	Description	Defaults
MLD prefix	The characters to use for the MLD prefix for MLDs on this file system	.MLD.
Label Range	The minimum and maximum sensitivity level for files and directories created on this file system	ADMIN_LOW to ADMIN_HIGH
Label	Label to infer for all files and directories on this file system that do not have an explicit label	None. NOTE: Files and directories in a fixed file system are assigned a default label when they are UFS-mounted, if the administrator has not assigned one.
Forced Privilege Set	Set of forced privileges to infer for all executable files on this file system that do not have explicit forced privileges	None.
Allowed Privilege Set	Set of allowed privileges to infer for all executable files on this file system that do not have explicit allowed privileges	None.

The Label Attribute

In variable file systems the label of each object is set when it is created and can be changed by an authorized user. In fixed file systems, a single label is assigned when the file system is mounted. The label can be changed only if an object is moved from the fixed file system. Because they are configured to have a single label when mounted on Trusted Solaris hosts, fixed attribute file systems are also referred to as single-label file systems.

The label is obtained differently when a fixed-attribute file system is NFS-mounted than when it is PCFS-mounted from a floppy disk or HSFS-mounted from a CDROM.

An NFS-mounted file system is assigned the label that is specified in the Default Label setting in the Security Families template assigned to the remote computer from which the file system is NFS-mounted.
For a PCFS- or HSFS-mounted fixed-attribute file system, the label is specified at mount time. either on the mount command line or in an entry in the vfstab_adjunct(4) file.

Specifying Security Attributes on Variable File Systems

(See "To Set Security Attributes on a File System ". The Security Administrator role uses the getfsattr(1M) command to get the security attributes of a file system. The setfsattr(1M) command tunes the attributes set on an already-existing file system ).

Caution -

Do not change or explicitly set the security attributes of the /, /usr, or /var file systems on a Trusted Solaris host. The results are unpredictable.

Specifying Security Attributes on Fixed File Systems

When mounting a fixed-attribute file system, the Security Administrator role can specify security attributes on the command line with the mount(1M) command, in the vfstab_adjunct(4) file, or in the /etc/auto_master file other autofs maps (see automount(1M)).

Note -

In the mount command, most of the keyword=value pairs used to specify security attributes with the -S can be specified with the -o option. If a keyword is followed by multiple values separated by commas, the keyword must be specified with the-S option becauses comma-separated values are not allowed after -o. Use of the -o option is preferable. For more about the security-related mount options that can be specified with the -o option, see "Mount Options Used for Protection ".

Any attributes specified at mount time are applied to all the files and directories in the mounted file system, if the files or directories themselves do not have the attribute. Any attributes on the file or directory are used. If the file or directory does not have an attribute and none is specified at mount-time, the defaults shown in Table 9-3 apply.

In fixed attribute file systems, the security attributes cannot change on an object as long as the object resides in the file system.

If, for example, the mounted file system /spare contains a file called test, no one can change the label of /spare/test. However, if /spare/test is copied into another directory such as /tmp or /export/home/secadmin, its label can be changed.

The following table shows the attributes that can be specified for a fixed attribute file system when the file system does not support the attribute, and the default vales that apply if no value for the attribute is supplied.

Table 9-3 Attributes Assignable to Fixed File Systems


Attribute	`-S` or `-o` Option Keyword to Use When Mounting	Default Values
MLD prefix	mld_prefix	`.MLD.`
Label Range	low_range, high_range	`ADMIN_LOW` to `ADMIN_HIGH`
Label	slabel=	Mounted from a CD-ROM or floppy disk - the label of the mounting process Mounted from an NFS server - the default label of the server in the `tnrhdb` database
Forced Privilege Set	forced=	None
Allowed Privilege Set	allowed=	None

The following example shows a command line to NFS-mount a fixed attribute file system called /spare from an NFS server running the Solaris operating environment. The server is called outside. /spare is mounted with a label of INTERNAL_USE_ONLY using mount with the -S option on the command line as shown here:

$ mount -F nfs -S "slabel=INTERNAL_USE_ONLY" outside:/spare /spare