JavaScript is required to for searching.
Skip Navigation Links
Exit Print View
Trusted Extensions Configuration Guide     Oracle Solaris 10 8/11 Information Library
search filter icon
search icon

Document Information


1.  Security Planning for Trusted Extensions

2.  Configuration Roadmap for Trusted Extensions

3.  Adding Trusted Extensions Software to the Oracle Solaris OS (Tasks)

4.  Configuring Trusted Extensions (Tasks)

Setting Up the Global Zone in Trusted Extensions

Check and Install Your Label Encodings File

Enable IPv6 Networking in Trusted Extensions

Configure the Domain of Interpretation

Create ZFS Pool for Cloning Zones

Reboot and Log In to Trusted Extensions

Initialize the Solaris Management Console Server in Trusted Extensions

Make the Global Zone an LDAP Client in Trusted Extensions

Creating Labeled Zones

Run the txzonemgr Script

Configure the Network Interfaces in Trusted Extensions

Name and Label the Zone

Install the Labeled Zone

Boot the Labeled Zone

Verify the Status of the Zone

Customize the Labeled Zone

Copy or Clone a Zone in Trusted Extensions

Adding Network Interfaces and Routing to Labeled Zones

Add a Network Interface to Route an Existing Labeled Zone

Add a Network Interface That Does Not Use the Global Zone to Route an Existing Labeled Zone

Configure a Name Service Cache in Each Labeled Zone

Creating Roles and Users in Trusted Extensions

Create Rights Profiles That Enforce Separation of Duty

Create the Security Administrator Role in Trusted Extensions

Create a Restricted System Administrator Role

Create Users Who Can Assume Roles in Trusted Extensions

Verify That the Trusted Extensions Roles Work

Enable Users to Log In to a Labeled Zone

Creating Home Directories in Trusted Extensions

Create the Home Directory Server in Trusted Extensions

Enable Users to Access Their Home Directories in Trusted Extensions

Adding Users and Hosts to an Existing Trusted Network

Add an NIS User to the LDAP Server

Troubleshooting Your Trusted Extensions Configuration

netservices limited Was Run After Trusted Extensions Was Enabled

Cannot Open the Console Window in a Labeled Zone

Labeled Zone Is Unable to Access the X Server

Additional Trusted Extensions Configuration Tasks

How to Copy Files to Portable Media in Trusted Extensions

How to Copy Files From Portable Media in Trusted Extensions

How to Remove Trusted Extensions From the System

5.  Configuring LDAP for Trusted Extensions (Tasks)

6.  Configuring a Headless System With Trusted Extensions (Tasks)

A.  Site Security Policy

B.  Using CDE Actions to Install Zones in Trusted Extensions

C.  Configuration Checklist for Trusted Extensions



Troubleshooting Your Trusted Extensions Configuration

In Trusted Extensions, the labeled zones communicate with the X server through the global zone. Therefore, the labeled zones must have usable routes to the global zone. Also, options that were selected during an Oracle Solaris installation can prevent Trusted Extensions from using interfaces to the global zone.

netservices limited Was Run After Trusted Extensions Was Enabled


Instead of running the netservices limited command before you enabled Trusted Extensions, you ran the command in the global zone afterwards. Therefore, your labeled zones are unable to connect to the X server in the global zone.


Run the following commands to open the services that Trusted Extensions requires to communicate between zones:

# svccfg -s x11-server setprop options/tcp_listen = true
# svcadm enable svc:/network/rpc/rstat:default

Cannot Open the Console Window in a Labeled Zone


When you attempt to open a console window in a labeled zone, the following error appears in a dialog box:

Action:DttermConsole,*,*,*,0 [Error]
Action not authorized.

Verify that the following two lines are present in each of the zone entries in the /etc/security/exec_attr file:

All Actions:solaris:act:::*;*;*;*;*:

If these lines are not present, the Trusted Extensions package that adds these entries was not installed in the labeled zones. In this case, re-create the labeled zones. For the procedure, see Creating Labeled Zones.

Labeled Zone Is Unable to Access the X Server


If a labeled zone cannot successfully access the X server, you might see messages such as the following:

  • Action failed. Reconnect to Solaris Zone?

  • No route available

  • Cannot reach globalzone-hostname:0


The labeled zones might not be able to access the X server for any of the following reasons:

  • The zone is not initialized and is waiting for the sysidcfg process to complete.

  • The labeled zone's host name is not recognized by the naming service that runs in the global zone.

  • No interface is specified as all-zones.

  • The labeled zone's network interface is down.

  • LDAP name lookups fail.

  • NFS mounts do not work.

Steps toward a solution:

Do the following:

  1. Log in to the zone.

    You can use the zlogin command or the Zone Terminal Console action.

    # zlogin -z zone-name

    If you cannot log in as superuser, use the zlogin -S command to bypass authentication.

  2. Verify that the zone is running.

    # zoneadm list

    If a zone has a status of running, the zone is running at least one process.

  3. Address any problems that prevent the labeled zones from accessing the X server.

    • Initialize the zone by completing the sysidcfg process.

      Run the sysidcfg program interactively. Answer the prompts in the Zone Terminal Console, or in the terminal window where you ran the zlogin command.

      To run the sysidcfg process noninteractively, you can do one of the following:

      • Specify the Initialize item for the /usr/sbin/txzonemgr script.

        The Initialize item enables you to supply default values to the sysidcfg questions.

      • Write your own sysidcfg script.

        For more information, see the sysidcfg(4) man page.

    • Verify that the X server is available to the zone.

      Log in to the labeled zone. Set the DISPLAY variable to point to the X server, and open a window.

      # DISPLAY=global-zone-hostname:n.n
      # export DISPLAY
      # /usr/openwin/bin/xclock

      If a labeled window does not appear, the zone networking has not been configured correctly for that labeled zone.

      Note - If you are running Trusted CDE starting with the Solaris 10 5/09 release, see Resolve Local Zone to Global Zone Routing in Trusted CDE.

    • Configure the zone's host name with the naming service.

      The zone's local /etc/hosts file is not used. Instead, equivalent information must be specified in the global zone or on the LDAP server. The information must include the IP address of the host name that is assigned to the zone.

    • No interface is specified as all-zones.

      Unless all your zones have IP addresses on the same subnet as the global zone, you might need to configure an all-zones (shared) interface. This configuration enables a labeled zone to connect to the X server of the global zone. If you want to restrict remote connections to the X server of the global zone, you can use vni0 as the all-zones address.

      If you do not want an all-zones interface configured, you must provide a route to the global zone X server for each zone. These routes must be configured in the global zone.

    • The labeled zone's network interface is down.

      # ifconfig -a

      Use the ifconfig command to verify that the labeled zone's network interface is both UP and RUNNING.

    • LDAP name lookups fail.

      Use the ldaplist command to verify that each zone can communicate with the LDAP server or the LDAP proxy server. On the LDAP server, verify that the zone is listed in the tnrhdb database.

    • NFS mounts do not work.

      As superuser, restart automount in the zone. Or, add a crontab entry to run the automount command every five minutes.