Device policy restricts or prevents access to devices that are integral to the system. The policy is enforced in the kernel.
Display the device policy for all devices on your system.
% getdevpolicy | more DEFAULT read_priv_set=none write_priv_set=none ip:* read_priv_set=net_rawaccess write_priv_set=net_rawaccess … |
In this example, the device policy for three devices is displayed.
% getdevpolicy /dev/allkmem /dev/ipsecesp /dev/hme /dev/allkmem read_priv_set=all write_priv_set=all /dev/ipsecesp read_priv_set=sys_net_config write_priv_set=sys_net_config /dev/hme read_priv_set=net_rawaccess write_priv_set=net_rawaccess |
Assume a role that includes the Device Security rights profile, or become superuser.
The Primary Administrator role includes the Device Security rights profile. You can also assign the Device Security rights profile to a role that you create. To create the role and assign the role to a user, see Example 9–3.
Add policy to a device.
# update_drv -a -p policy device-driver |
Specifies a policy for device-driver.
Is the device policy for device-driver. Device policy specifies two sets of privileges. One set is required to read the device. The other set is required to write to the device.
Is the device driver.
For more information, see the update_drv(1M) man page.
In the following example, device policy is added to the ipnat device.
# getdevpolicy /dev/ipnat /dev/ipnat read_priv_set=none write_priv_set=none # update_drv -a \ -p 'read_priv_set=net_rawaccess write_priv_set=net_rawaccess' ipnat # getdevpolicy /dev/ipnat /dev/ipnat read_priv_set=net_rawaccess write_priv_set=net_rawaccess |
In the following example, the read set of privileges is removed from the device policy for the ipnat device.
# getdevpolicy /dev/ipnat /dev/ipnat read_priv_set=net_rawaccess write_priv_set=net_rawaccess # update_drv -a -p write_priv_set=net_rawaccess ipnat # getdevpolicy /dev/ipnat /dev/ipnat read_priv_set=none write_priv_set=net_rawaccess |
By default, the as audit class includes the AUE_MODDEVPLCY audit event.
Assume the Primary Administrator role, or become superuser.
The Primary Administrator role includes the Primary Administrator profile. To create the role and assign the role to a user, see Chapter 2, Working With the Solaris Management Console (Tasks), in System Administration Guide: Basic Administration.
Preselect the audit class that includes AUE_MODDEVPLCY audit event.
Add the as class to the flags line of the audit_control file. The file would appear similar to the following:
# audit_control file dir:/var/audit flags:lo,as minfree:20 naflags:lo |
For detailed instructions, see How to Modify the audit_control File.
Applications that retrieve Solaris IP MIB-II information should open /dev/arp, not /dev/ip.
Determine the device policy on /dev/ip and /dev/arp.
% getdevpolicy /dev/ip /dev/arp /dev/ip read_priv_set=net_rawaccess write_priv_set=net_rawaccess /dev/arp read_priv_set=none write_priv_set=none |
Note that the net_rawaccess privilege is required for reading and writing to /dev/ip. No privileges are required for /dev/arp.
Open /dev/arp and push the tcp and udp modules.
No privileges are required. This method is equivalent to opening /dev/ip and pushing the arp, tcp and udp modules. Because opening /dev/ip now requires a privilege, the /dev/arp method is preferred.