Additional Trusted Extensions Configuration Tasks

The following two tasks enable you to transfer exact copies of configuration files to every Trusted Extensions system at your site. The final task enables you to remove Trusted Extensions customizations from an Oracle Solaris system.

How to Copy Files to Portable Media in Trusted Extensions

When copying to portable media, label the media with the sensitivity label of the information.

Before You Begin

To copy administrative files, you must be in the root role in the global zone.

1. Allocate the appropriate device.

   Use the Device Manager, and insert clean media. For details, see How to Allocate a Device in Trusted Extensions in Oracle Solaris Trusted Extensions User Guide.

   The File Browser displays the contents of the clean media.

2. Open a second File Browser.
3. Navigate to the folder that contains the files to be copied

   For example, you might have copied files to an /export/clientfiles folder.

4. For each file, do the following:
   1. Highlight the icon for the file.
   2. Drag the file to the File Browser for the portable media.
5. Deallocate the device.

   For details, see How to Deallocate a Device in Trusted Extensions in Oracle Solaris Trusted Extensions User Guide.

6. On the File Browser for the portable media, choose Eject from the File menu.

   ---

   Note - Remember to physically affix a label to the media with the sensitivity label of the copied files.

   ---

Example 4-6 Keeping Configuration Files Identical on All Systems

The system administrator wants to ensure that every system is configured with the same settings. So, on the first system that is configured, the administrator creates a directory that cannot be deleted between reboots. In that directory, the administrator places the files that must be identical or very similar on all systems.

For example, the administrator modifies DNS lookups and the policy.conf file for this site. So, the administrator copies the following files to the permanent directory.

# mkdir /export/commonfiles
# cp /etc/security/policy.conf \ /etc/resolv.conf \ /etc/nsswitch.conf \ /export/commonfiles

The administrator uses the Device Manager to allocate a CD-ROM in the global zone, and transfers the files to the CD. On a separate CD-ROM, labeled ADMIN_HIGH, the administrator puts the label_encodings file for the site.

How to Copy Files From Portable Media in Trusted Extensions

It is safe practice to rename the original Trusted Extensions file before replacing the file. When configuring a system, the root role renames and copies administrative files.

Before You Begin

To copy administrative files, you must be in the root role in the global zone.

1. Allocate the appropriate device.

   For details, see How to Allocate a Device in Trusted Extensions in Oracle Solaris Trusted Extensions User Guide.

   The File Browser displays the contents.

2. Insert the media that contains the administrative files.
3. If the system has a file of the same name, copy the original file to a new name.

   For example, add .orig to the end of the original file:

   # cp /etc/security/tsol/tnrhtp /etc/security/tsol/tnrhtp.orig

4. Open a File Browser.
5. Navigate to the desired destination directory, such as /etc/security/tsol
6. For each file that you want to copy, do the following:
   1. In the File Browser for the mounted media, highlight the icon for the file.
   2. Then, drag the file to the destination directory in the second File Browser.
7. Deallocate the device.

   For details, see How to Deallocate a Device in Trusted Extensions in Oracle Solaris Trusted Extensions User Guide.

8. When prompted, eject and remove the media.

Example 4-7 Loading Common Configuration Files in Trusted Extensions

In this example, the root role needs to copy configuration files to portable media. These files are to be copied to each Trusted Extensions system.

First, the root role allocates the floppy_0 device in the Device Manager and responds yes to the mount query. Then, the root role inserts a clean diskette that is labeled Trusted Path. The administrator then navigates to the configuration files and copies them to the diskette.

To read from the diskette, the root role allocates the floppy_0 device on the receiving system, then downloads the contents.

How to Remove Trusted Extensions From the System

To remove Trusted Extensions from your Oracle Solaris system, you perform specific steps to remove Trusted Extensions customizations to the Oracle Solaris system.

1. Archive any data in the labeled zones that you want to keep.

   For portable media, affix a physical sticker with the sensitivity label of the zone to each archived zone.

2. Remove the labeled zones from the system.

   For details, see How to Remove a Non-Global Zone in System Administration Guide: Oracle Solaris Zones, Oracle Solaris 10 Containers, and Resource Management.

3. Disable the Trusted Extensions service.

   # svcadm disable labeld

4. Disable the audit service.

   # audit -t

5. Disable device allocation.

   # svcadm disable allocate

6. (Optional) Reboot the system.
7. Configure the system.

   Various services might need to be configured for your Oracle Solaris system. Candidates include auditing, basic networking, naming services, and file system mounts.