This appendix discusses site security policy issues that affect a labeled network. For site security issues that affect any Oracle Solaris installation, see Appendix A, Site Security Policy and Enforcement, in Oracle Solaris 11.4 Security and Hardening Guidelines.
Each Trusted Extensions site is unique and must determine its own security policy. In addition to the recommendations in Appendix A, Site Security Policy and Enforcement, in Oracle Solaris 11.4 Security and Hardening Guidelines, perform the following due diligence at a Trusted Extensions site:
Educate users about Trusted Extensions software.
Determine which labels are used in the system and whether the ADMIN_LOW and ADMIN_HIGH labels will viewable by regular users.
Determine which user clearances are assigned to individuals.
Determine which devices (if any) can be allocated by which regular users.
Determine which label ranges are defined for systems, printers, and other devices.
Determine whether Trusted Extensions is used in an evaluated configuration or not.
Assign the maximum label of a system that is configured with Trusted Extensions to not be greater than the maximum security level of work being done at the site.
Ensure that an administrator regularly verifies that regular users have a valid login shell.
Ensure that an administrator regularly verifies that regular users have valid user ID values and not system administration ID values.
Ensure that an administrator regularly monitors that users do not change the labels on a file to allow other users to read the file.