NAME | Description | Attributes | See Also | Notes
Labels are attributes that are used in mandatory policy decisions. Labels are associated, either explicitly or implicitly, with all subjects (generally processes) and objects (generally things with data such as files) that are accessible to subjects. The default Trusted Extensions mandatory policy labels are defined by a site's security administrator in label_encodings(4).
Various mandatory policies might be delivered in the lifetime of Solaris Trusted Extensions.
The default mandatory policy of Trusted Extensions is a Mandatory Access Control (MAC) policy that is equivalent to that of the Bell-LaPadula Model of the Lattice, the Simple Security Property, and the *-Property (Star Property), with restricted write up. The default mandatory policy is also equivalent to the Goguen and Mesegeur model of Non-Inteference.
For this MAC policy, two labels are always defined: admin_low and admin_high. The site's security administrator defines all other labels in label_encodings(4). admin_low is associated with all normal user readable (viewable) Trusted Extensions objects. admin_high is associated with all other Trusted Extensions objects. Only administrative users have MAC read (view) access to admin_high objects and only administrative users have MAC write (modify) access to admin_low objects or admin_high objects.
Users interact with labels as strings. Graphical user interfaces and command line interfaces present the strings as defined in label_encodings(4). Human readable labels are classified at the label that they represent. Thus the string for a label A is only readable (viewable, translatable to or from human readable to opaque m_label_t) by a subject whose label allows read (view) access to that label.
In order to store labels in publicly accessible (admin_low) name service databases, an unclassified internal text form is used. This textual form is not intended to be used in any interfaces other than those that are provided with the Trusted Extensions software release that created this textual form of the label.
Applications interact with labels as opaque (m_label_t) structures. The semantics of these opaque structures are defined by a string to m_label_t translation. This translation is defined in label_encodings(4). Various Application Programming Interfaces (API) translate between strings and m_label_t structures. Various APIs test access of subject-related labels to object-related labels.
See attributes(5) for description of the following attributes:
ATTRIBUTE TYPE |
ATTRIBUTE VALUE |
---|---|
Interface Stability |
See NOTES below |
chk_encodings(1M), blcompare(3TSOL), label_to_str(3TSOL), m_label_alloc(3TSOL), m_label_dup(3TSOL), m_label_free(3TSOL), str_to_label(3TSOL), label_encodings(4), attributes(5)
Bell, D. E., and LaPadula, L. J. Secure Computer Systems: Unified Exposition and Multics Interpretation, MTR-2997 Rev. 2, MITRE Corp., Bedford Mass., March 1976. NTIS AD-A023 588/7.
Goguen, J. A., and Mesegeur, J.: Security Policies and Security Models, Proceedings 1982 Symposium on Security and Privacy, IEEE Computer Society Press, 1982, p 11-20.
Goguen, J. A., and Mesegeur, J.: Unwinding and Interference Control, Proceedings 1984 Symposium on Security and Privacy, IEEE Computer Society Press, 1984, p 75-86.
The stability of the labels implementation is Stable for systems that implement the Defense Intelligence Agency (DIA) MAC policy of label_encodings(4). Other policies might exist in a future release of Trusted Extensions that might obsolete or supplement label_encodings.
Internal text labels are not an interface and might change with any release of Trusted Extensions. They are only intended for input and generation on the same release of Trusted Extensions software.
As a potential porting aid for Trusted Solaris 8 applications, the opaque structure names bslabel_t, blevel_t, and bclear_t are defined to be equivalent to m_label_t. Like m_label_t, these types must be ported as opaque pointers. The same must be done with the various Trusted Solaris 8 label interfaces. These Trusted Solaris 8 structures and interfaces are Obsolete and might be removed from a future release of Trusted Extensions.
NAME | Description | Attributes | See Also | Notes
NAME | Synopsis | Description | Options | Return Values | Attributes | See Also | Notes
/usr/lib/security/pam_tsol_account.so.1
The Solaris Trusted Extensions service module for PAM, /usr/lib/security/pam_tsol_account.so.1, checks account limitations that are related to labels. The pam_tsol_account.so.1 module is a shared object that can be dynamically loaded to provide the necessary functionality upon demand. Its path is specified in the PAM configuration file.
pam_tsol_account.so.1 contains a function to perform account management, pam_sm_acct_mgmt(). The function checks for the allowed label range for the user. The allowable label range is set by the defaults in the label_encodings(4) file. These defaults can be overridden by entries in the user_attr(4) database.
By default, this module requires that remote hosts connecting to the global zone must have a CIPSO host type. To disable this policy, add the allow_unlabeled keyword as an option to the entry in pam.conf(4), as in:
other account required pam_tsol_account allow_unlabeled |
The following options can be passed to the module:
Allows remote connections from hosts with unlabeled template types. See tnrhtp(4).
Provides debugging information at the LOG_DEBUG
level.
See syslog(3C).
The following values are returned:
The account is valid for use at this time and label.
The current process label is outside the user's label range, or the label information for the process is unavailable, or the remote host type is not valid.
Returns an error code that is consistent with typical PAM operations. For information on error-related return values, see the pam(3PAM) man page.
See attributes(5) for description of the following attributes:
ATTRIBUTE TYPE |
ATTRIBUTE VALUE |
---|---|
Interface Stability |
Evolving |
MT Level |
MT-Safe with exceptions |
keylogin(1), syslog(3C), libpam(3LIB), pam(3PAM), pam_sm_acct_mgmt(3PAM), pam_start(3PAM), label_encodings(4), pam.conf(4), tnrhtp(4), user_attr(4), attributes(5)
Chapter 17, Using PAM, in System Administration Guide: Security Services
The interfaces in libpam(3LIB) are MT-Safe only if each thread within the multi-threaded application uses its own PAM handle.
NAME | Synopsis | Description | Options | Return Values | Attributes | See Also | Notes