test

Trusted Solaris User's Guide

Chapter 4 Elements of the Trusted Solaris Environment

After you have successfully completed the login process, you can work within the Trusted Solaris environment, subject to the restrictions of your clearance, authorizations, and your choice of a single-level or multi-level session. This chapter explains the key elements in the Trusted Solaris environment. The chapter discusses these topics:

Basic Trusted Solaris Environment

There are four major differences between the Trusted Solaris environment (see the following figure) and the standard Solaris environment:

Figure 4-1 Basic Trusted Solaris Environment

Graphic

Label Displays in the Trusted Solaris Environment

As discussed in "Mandatory Access Control", all applications and files in the Trusted Solaris environment have labels (which may be hidden or visible) associated with them. The Trusted Solaris environment displays these labels in:

The following figure shows how labels display in an environment configured to display labels. It also shows the pointer and indicator when you select Query Window. (Labels appear inside square brackets ([]).)

Figure 4-2 Window Labels in the Trusted Solaris Environment

Graphic

A site can also be configured to hide labels, as shown in the following figure.

Figure 4-3 Trusted Stripe with Labels Suppressed

Graphic

Trusted Stripe

The trusted stripe appears in a reserved area at the bottom of the screen in all Trusted Solaris sessions. Its purpose is to give you a visual confirmation that you are in a legitimate Trusted Solaris session, to let you know when you are interacting with the trusted computing base, and to indicate the labels of your current workspace and window. The trusted stripe cannot be moved or obscured by other windows or dialog boxes. There are potentially two elements of the trusted stripe (depending on your site configuration):

Trusted Path Symbol

Whenever you access any portion of the trusted computing base, the trusted path symbol appears at the left of the trusted stripe area. (If your configuration suppresses labels, then the trusted path symbol appears with the trusted stripe to the left of the Front Panel as shown in Figure 4-3.) The trusted path symbol is not displayed when the pointer is focused in a window or area of the screen that does not affect security. The trusted path symbol cannot be forged; if you see it, you can be sure that you are safely interacting with the trusted computing base.

Caution - Caution -

If the trusted stripe is missing from your window environment (other than when you lock your screen) or if the trusted path symbol is missing when you are attempting a security-related action, notify your Trusted Solaris administrator at once; there is a serious problem with your system. If the trusted stripe is visible when you lock your screen, this may be a problem as well.

Window Label Indicator

The Window Label indicator displays the label of the active window (the window that has the pointer focus). If you are working at one label at a time, this may be stating the obvious. However, in a multi-level session, you may have windows with different labels in the same workspace. For an example, see "Tour: Occupying Workspaces with Applications at Different Labels".

Front Panel

The Trusted Solaris Front Panel is very similar to the one used in standard CDE. It is more limited in that it provides access to only those applications, files, and utilities permitted that you are allowed to use. Clicking mouse button 3 anywhere in the workspace switch area causes a special pop-up menu called the Trusted Path (TP) menu to be displayed.

Before you can access a device through the Removable Media Manager, that device must be allocated using the Device Allocation Manager. The Device Allocation Manager is accessed from the Tools subpanel, which is above the Style Manager icon in the Front Panel.

If you minimize the Front Panel, you can restore it by clicking anywhere in the Trusted Stripe, double-clicking the minimized Front Panel icon, or selecting Minimize/Restore Front Panel from the Workspace menu.

In the Trusted Solaris environment, Install Icon dropsites are limited to applications and files permitted in your user account and subject to any limitations on the particular application. For example, an application may not be operational below a set label.

For more information on standard CDE, see the Common Desktop Environment User's Guide.

Workspace Switch Area

In the Trusted Solaris environment, the workspace buttons not only define separate workspaces but let you work at different labels if you are conducting a multi-level session (in a single-level session, you can only operate at one label). When you begin a multi-level session, each workspace is set to the lowest label assigned to you. If your administrator has color-coded workspace buttons by classification, the workspace buttons will appear in the appropriate color.

To Change to a Workspace at a Different Label

  1. Click mouse button 3 over the workspace button and choose Change Workspace Label from the menu.

    A label builder is displayed.

  2. Type the new label.

    You can then click the workspace button to work at the new label.

    Note that the Occupy Workspace and Occupy All Workspaces selections in the window menus let you display windows with different labels in the same workspace.

Clock

The clock works exactly the same as in the standard CDE environment. In the Trusted Solaris environment, however, only an administrator can change the date and time for your workstation.

Calendar

The calendar shows the appointments for you at the label of your current workspace only. To view appointments at a different label, you need to change to a workspace at that label if you are in a multi-level session or log out and back in if you are in a single-level session.

File Manager

In the Trusted Solaris environment, File Manager has certain limitations on the files (and folders) that it can display. File Manager displays files at the label of the current workspace. To operate on (or view) files at more than one label at a time, you run File Manager from workspaces at different labels and then use the Occupy Workspace command to display the different File Managers in the same workspace.

File Manager enables you to change a file or folder's basic permissions, access control list (ACL), and information. You can also move, copy, or link files between File Managers at different labels. For more information on File Manager and its capabilities, see Chapter 5, Managing Labels on Files and Directories.

You can view (but not write to) files and directories that are not at your current workspace label by specifying a path name with adornments, as in /.MLD.myHomeDir/.SLD.0. However, you can only write to files and directories dominated by your current workspace label.

Text Editor

The Text Editor can edit files at the label of the current workspace only. If you need to move data from a Text Editor to a file at a different label, you change a workspace label, open the Text Editor at the second label, and copy the text in one Text Editor and paste it in the other.

Personal Applications Subpanel

The default applications in the personal applications operate basically the same as in the standard CDE environment. The Terminal icon launches the default shell assigned to you by your administrator. When you use a web browser, the label of the browser must be the same as the label of the web server.

Mailer

In the Trusted Solaris environment, all mail messages are assigned a label. The Mailer sorts incoming mail by label and role and displays separate mail notifier icons in its subpanel (see Figure 4-4). This feature enables you to focus on mail at labels of interest to you and defer reading mail at other labels. The Mailer operates at one label at a time only. Clicking the Mailer icon in the Front Panel opens the Mailer at the label of the current workspace; clicking a Mailer icon with a label in the subpanel opens the Mailer at that label.

Figure 4-4 Mail Notifier Icons in the Mail Subpanel

Graphic

When you send a message, it will go out at the label of the mail tool in which you compose it. Only hosts and users that are cleared for that label will receive the message.

If you need to use the vacation message option in the Mailer, you must explicitly enable vacation message replies for each label at which you typically receive mail. Check with your security administrator for your site's security policy for vacation messages.

The CDE Mailer is supplied by default. If you prefer a different mail application, contact your administrator to ensure that your preferred mail application is installed properly. Although you can install a different mail application by dropping its icon on the Install Icon dropsite in the subpanel, you will lose the notification-by-label feature.

Printer

The Print Manager in the Personal Printers subpanel displays icons for all printers accredited up to your clearance. However, you can use only those printers accredited to print documents at the label of the current workspace.

A typical print job in the Trusted Solaris environment includes:

A typical banner page appears in the following figure. The words "JOB START" indicate the banner page.

Figure 4-5 Typical Print Banner Page

Graphic

For the exact security information regarding printing at your site, please see your administrator.

Desktop Style Manager

The Desktop Style Manager operates in the same manner as in the standard Solaris environment with two exceptions:

Application Manager

The Application Manager provides access to only those applications and utilities that have been assigned to you by your administrator. If you can assume a role, you will have access to a different set of applications and capabilities. Remember that the ability of a function to operate on a file depends on the label of the current workspace.

Similarly, although you can add applications to the Personal Application submenu by dropping icons onto the Install Icon dropsite, you can only run them if your administrator has assigned these applications to you.

Trash Can

In the Trusted Solaris environment, the trash can stores files to be deleted by label. Although you can drop files at any label in the trash can, it displays files at the current label only. You cannot view files that are in the trash can at other labels. Use the Shred selection from the File menu in the trash can window to delete sensitive information as soon as you put it in the trash can.

Trusted Path Menu

The Trusted Path (TP) menu is accessed by holding down mouse button 3 in the switch area of the Front Panel (see the following figure).

The Trusted Path menu adds the following menu items to the normal switch menu items:

Note -

The Add Workspace command operates similarly to the standard version of CDE except that the new workspace button takes on the security characteristics of the workspace under the point or, if the pointer is not over a workspace button, the characteristics of your minimum label.

Tasks related to these menu items are described in the following sections.

To Change the Workspace Label

  1. Choose Change Workspace Label.

    A label builder dialog box is displayed.

  2. Type a new label.

    The label (and, if implemented, the color) of the workspace button changes. When you click the workspace button, you enter a session at the new label.

To Change Roles

  1. Choose Assume Role Role from the Trusted Path menu.

    A dialog box is displayed requesting the password for the role.

  2. Type the password.

    A workspace button with the role name is displayed and you are shifted to this workspace.

    The role workspace provides you with the special set of applications, privileges, authorizations, and the UID assigned to this role. Remember that for auditing purposes, your user account UID is attached to all transactions you make while in this role.

Figure 4-6 Role Password Dialog Box

Graphic

To Allocate a Device

The Allocate Device menu item is available to authorized users only. It enables you to mount and allocate a device so that you can securely move data on or off the system to another medium. If you try to use a device without allocating it, you will get the error message "Permission Denied".

  1. Choose Allocate Device from the Trusted Path menu, or choose Device Allocation Manager from the Tools subpanel in the Front Panel.

    The Device Allocation Manager is displayed.

  2. Look at the available device list for the device you wish to use.

    The devices that you are permitted to allocate at your current label appear in this list. If the device you want to use does not appear in the list, you should check with your adminsitrator to make sure you are properly authorized. It may also be that the device is in an error state or in use by someone else.

  3. Move the device you want to use from the Available Devices list to the Allocated Devices list by double-clicking the device name in the Available Devices list or selecting the device and clicking the Allocate (right-pointing) button.

    Table 4-1 Device Name Abbreviations

    Abbreviated Device Name 

    Long Version of Device Name 

    audio 

    microphone and speakers 

    floppy_0 

    floppy drive 

    mag_tape_0 

    tape drive (streaming) 

    cdrom_0 

    CDROM drive 

    This step starts the clean script. The clean script ensures that there is no data left over on the medium from other transactions.

    Note that the label of the current workspace will be applied to the device. Any data transferred to or from the device's medium must be dominated by this label.

  4. Follow the instructions in the clean script dialog boxes to load and make sure the medium has the correct label, and to mount the device.

    The device name now appears in the Allocated Devices list.

    Note -

    Until you close the command tool window, the Device Allocation Manager and its label builder windows are disabled. At this point, you will not be able to use the Device Allocation Manager in this workspace or any other.

  5. Use the device to transfer data.

    At any point, if you switch to a workspace with a different User ID (by assuming a role) or label, you need to make a separate allocation of the device at the label for that workspace. When you use the Occupy Workspace command from the window menu to move the Device Allocation Manager to the new workspace, the Available and Allocated Devices lists change to reflect the correct context.

  6. Deallocate the device when you are finished by double-clicking the device name in the Allocated Devices list or selecting the device and clicking the Deallocate (left-pointing) button.

    For the sake of security, you should always deallocate a device when you are finished using it. Deallocating a device runs a clean script that unmounts the device and advises you when the media can be removed.

    Note -

    If you reboot your system while devices are allocated, they become deallocated.

To Interactively Display a Window Label

This operation is mainly useful if your system is not configured to display labels in the window frames.

  1. Choose Query Window Label from the Trusted Path menu.

    The pointer changes to a question mark.

  2. Move the pointer around the screen.

    The label for the region under the pointer is displayed in a small rectangular box at the center of the screen (see below).

  3. Click the mouse button to return to normal mode.

Figure 4-7 Query Window Label Operation

Graphic

Changing Your Password

The Change Password menu item enables you to change your password. Changing passwords on a frequent basis shortens the window of opportunity for intruders using illegally obtained passwords; thus, your site's policy may require you to change your password regularly. Your administrator has a number of options for changing your password:

If your administrator has implemented one of the options requiring you to change your password, you should receive a message warning you to change your password prior to the cutoff date. You will be required to change your password by one of two methods, depending on your site's security policy:

Passwords must meet the following criteria:

To Change Passwords by Direct Entry

  1. Choose Change Password from the Trusted Path menu.

    You access the Trusted Path menu by holding down mouse button 3 while the pointer is over the switch area in the Front Panel.

  2. Choose a new password.

  3. Type your old password in the Change Password dialog box and click OK.

    Figure 4-8 Change Password Dialog Box

    Graphic

    This confirms that you are the legitimate user associated with this user name. For the sake of security, the password is not displayed as you type it.

    Caution - Caution -

    When you enter your password, make sure that the cursor is over the Change Password dialog box and that the trusted path symbol is displayed. If the cursor is not over the dialog box, you might inadvertently type your password into a different window where it could be seen by another user. If the symbol is not displayed, then someone may be attempting to steal your password and you should notify your security administrator at once.

  4. Type the new password in the Change Password Confirmation dialog box and click OK.

    Figure 4-9 Change Password Confirmation Dialog Box

    Graphic

  5. Type the new password in the Change Password Reconfirmation dialog box and click OK.

    Figure 4-10 Change Password Reconfirmation Dialog Box

    Graphic

    This step confirms your choice.

  6. Click the OK button in the dialog box that notifies you that the change has been made.

To Change Passwords by Choosing From a List

Your administrator has the option to require users to select new passwords from lists of system-generated passwords. Trusted Solaris software generates passwords that are pronounceable but difficult for intruders to guess.

  1. Select Change Password from the Trusted Path menu.

    A dialog box requesting your current password is displayed (see Figure 4-8).

  2. Type your password and click OK.

    A dialog box similar to the one shown below is displayed (if your system is configured for system-generated entry). The Password Generator dialog box provides you with a choice of five unique system-generated passwords. The pronunciation mnemonic shown in parentheses to the right of each password divides the password into syllables to make it easier to remember.

    Figure 4-11 Password Generator Dialog Box

    Graphic

  3. Read the five password choices.

    • If you want to use one of these choices, type it in the confirmation field and press Return or click OK.

      This step establishes your choice.

    • If you want to select from a different set of choices, leave the confirmation field blank and press Return or click OK.

      Five new selections are displayed. Repeat this step until you find a password that you want to use.

  4. After you are prompted for the password again, type choice in the confirmation field and press Return or click OK.

    This step confirms the spelling of your choice and gives you practice at entering it. It also closes the dialog box.

To Choose a Password From a List at the Command Line

A command line version of the password generator is provided as an alternative to the Password Generator dialog box.

Note -

Command-line password choice is available to users in administrative roles only.

  1. In a terminal window, type passwd.

    A set of five generated password choices is listed.

    Select password from list:
      rocskovi          [ rocs-kov-i ]
      phuzpeca          [ phuz-pec-a ]
      bephzoba          [ beph-zo-ba ]
      eblircit          [ e-blirc-it ]
      yeaskedo          [ yeas-ke-do ]

Type password to confirm,
or Return for more choices:

  2. Read the five password choices.

    • If you want to use one of these choices, enter it and press Return.

      This step establishes your choice.

    • If you want to select from a different set of choices, press Enter without making an entry.

      Five new selections are displayed. Repeat this step until you find a password you want to use.

  3. After you are prompted for the password again, type your choice in the confirmation field and press Return.

    This step confirms the spelling of your choice and gives you practice at entering it.