This section identifies known problems in the Trusted Solaris 8 HW 12/02 software, describes the problems, and suggests solutions. These bugs might or might not be fixed in a future release.
Trusted Solaris Installation and Configuration instructs the installer to remove the boot diskette.
Workaround: If you have booted from a CD-ROM and have not used a diskette, you can ignore the instruction. Leave the CD-ROM in the drive, let the system reboot, and remove the CD-ROM when instructed to. If you are doing an upgrade install, the system will not automatically reboot after the installation of the first CD.
The smartcard -c enable command updates the pam.conf file incorrectly. The result is that the user is unable to log in with a smart card.
Workaround: In the secadmin role, do the following steps:
Before configuring smart card, save the /etc/pam.conf file.
$ cp /etc/pam.conf /etc/pam.conf.orig |
Configure smart card using the Smart Card Admin GUI. The executable is /usr/dt/bin/sdtsmartcardadmin.
Enable smart card with the following command:
$ smartcard -c enable |
Before logging out, restore the /etc/pam.conf file.
$ cp /etc/pam.conf.orig /etc/pam.conf |
Add the following lines to the /etc/pam.conf file.
You add lines that contain pam_smartcard for both dtlogin and dtsession. You append 'use_first_pass' to the dtlogin and dtsession lines that contain pam_unix.
The lines in the pam.conf file should not contain continuation characters. For display purposes, the lines below contain continuation (\) characters.
dtlogin auth requisite /usr/lib/security/$ISA/pam_smartcard.so.1 dtlogin auth requisite /usr/lib/security/$ISA/pam_tp_auth.so.1 dtlogin auth requisite /usr/lib/security/$ISA/pam_unix.so.1 \ check_retries use_first_pass … dtsession auth requisite /usr/lib/security/$ISA/pam_smartcard.so.1 dtsession auth required /usr/lib/security/$ISA/pam_unix.so.1 \ use_first_pass |
When a patch is released, you can apply the patch to your system. Once the patch is applied, you do not need the workaround.
This release supports only the C locale (U.S. English). Thus, no Languages CD is provided.
Network packets that use the TSIX protocol are not processed correctly when AH headers are present.
Workaround: None.
Network packets that are labeled with the TSOL protocol are not processed correctly by IKE in the SunScreenTM 3.2 product. The SunScreen log messages show IKE_INVALID_COOKIE.
The SunScreen software properly processes TSOL-labeled network traffic that is in clear text. The SunScreen IKE software also behaves correctly in the Trusted Solaris operating environment to protect traffic between unlabeled network connections.
Workaround: None.
A SIGSEGV error is produced when using the nisaddent -avf command to add an incorrectly formatted file to the tnrhdb NIS+ map. The incorrectly formatted file produces a core dump.
Workaround: The nisaddent command works correctly with a valid input file. To ensure that the input file has fields separated by colons and not by spaces, use niscat -s : when dumping an NIS+ table that will be used later as input to NIS+.
This bug occurs in a very unusual situation. The administrator must have consciously configured an NFS remote host to be at one label, and the label range to be another label.
Workaround: To prevent the creation of files at the default label for the server, mount the file system as “read-only”. Existing files are unaffected, but the read-only mount option prevents the creation of files at a label outside the label range.
The new utilities sdtgwm, sdtwsm, and sdtwinlst and their corresponding actions in the Desktop_Apps folder generate errors, such as Warning: Query Module Not Running.
Workaround: None. These tools are inappropriate for users in the Trusted Solaris environment. Thus, the tools are not supported.
The bug is known to occur when the Solaris Management Console is running on an NIS+ client or master and has loaded its toolbox from an NIS+ replica. Next, the replica is shut down and the Solaris Management Console is used to update any NIS+ maps. Since the machine from which the Solaris Management Console loaded its toolbox is down, the Solaris Management Console client has no way to communicate with the Solaris Management Console server, which is the machine from which the toolbox has been loaded.
Workaround: Do not use the Solaris Management Console to update NIS+ databases when an NIS+ replica is down. Use the standard NIS+ command-line interface instead.
Although Trusted Solaris 8 4/01 software does not support information labels (ILs), the chk_encodings command fails with the following error if the label_encodings file omits information about ILs.
# chk_encodings label_encodings Label encodings conversion error at line 37: Can't find INFORMATION LABELS specification. Found instead: "SENSITIVITY LABELS:". label_encodings: label encodings syntax check failed.
Workaround: Copy a valid SENSITIVITY LABELS: section in your label_encodings file, and rename the section to INFORMATION LABELS:, as in:
INFORMATION LABELS: ... WORDS: ... REQUIRED COMBINATIONS: ... COMBINATION CONSTRAINTS: ...See the label_encodings(4) man page for more information.
The Solaris Management Console commands smosservice and smdiskless do not work correctly.
Workaround: Set up diskless service manually. On the OS server, name and allocate the client disk partitions during the installation process.
Drag-and-drop operations do not work reliably for OPEN LOOK applications.
Workaround: Use the copy and paste keys with OPEN LOOK applications.
This bug is seen when you perform the following steps:
Insert diskette.
floppy_0 is allocated by Device Allocation Manager.
From File Manager, click the File menu and select Removable Media Manager.
Select the diskette icon. Click mouse button 3 to open the Labels menu item.
In Removable Media Manager - File Labels (the Trusted Solaris Label Builder), click the Help button at bottom right of the dialog box.
Workaround: Perform the following steps:
Click mouse button 3 on the Front Panel and select Help from the menu. The Workspace Manager – Help window appears.
In the Workspace Manager – Help window, scroll down in the top pane to Trusted Solaris Applications and select that text.
In the bottom pane, click Create Labels.
The Solaris Management Console Mounts tool and Solaris Management Console Shares tool do not manipulate Trusted Solaris attributes.
Workaround: Use the Set Mount Points action and the Share Filesystems action to handle Trusted Solaris attributes. You can also use the Admin Editor on the /etc/vfstab file and the /etc/dfs/dfstab file.