Adding Multilevel (Labeled) Security

Trusted Extensions extends Oracle Solaris security by enforcing a mandatory access control (MAC) policy. Sensitivity labels are automatically applied to all sources of data (networks, file systems, and windows) and consumers of data (user and processes). Access to all data is restricted based on the relationship between the label of the data (object) and the consumer (subject). The layered functionality consists of a set of label-aware services.

A partial list of Trusted Extensions services includes:

• Labeled networking

• Label-aware file system mounting and sharing

• Labeled desktop

• Label configuration and translation

• Label-aware system management tools

• Label-aware device allocation

The group/feature/trusted-desktop packages provide the Oracle Solaris multilevel, trusted desktop environment.

Configuring Trusted Extensions

You must install the Trusted Extensions packages, then configure the system. After package installation, the system can run a desktop with a directly connected bitmapped display, such as a laptop or workstation. Network configuration is required to communicate with other systems.

For information and procedures see the following:

• Part I, Initial Configuration of Trusted Extensions, in Trusted Extensions Configuration and Administration

• Part II, Administration of Trusted Extensions, in Trusted Extensions Configuration and Administration

Configuring Labeled IPsec

You can protect your labeled packets with IPsec.

For information and procedures see the following:

• Chapter 6, IP Security Architecture (Overview), in Securing the Network in Oracle Solaris 11.1

• Administration of Labeled IPsec in Trusted Extensions Configuration and Administration

• Configuring Labeled IPsec (Task Map) in Trusted Extensions Configuration and Administration