Trusted Extensions Developer's Guide

Index

A

abbreviations used in interface namesAbbreviations Used in Interface Names and Data Structure Names

access

checks for

networkCommunication Endpoints

socketsAF_UNIX Family

file labelsPrivileged Operations and Labels

guidelines for labelsPrivileged Operations and Labels

multilevel port connectionsMultilevel Port Information

ADMIN_HIGH labelLabels in the Global Zone

ADMIN_LOW labelLabels in the Global Zone

APIs

clearance labelClearance Label APIs

declarationsTrusted Extensions API Reference

examples of Trusted Extensions in Oracle SolarisUnderstanding Labels

for Oracle Solaris that use Trusted Extensions parametersOracle Solaris Library Routines and System Calls That Use Trusted Extensions Parameters

for zone labels and zone pathsLabeled Zones

introduction toSensitivity Labels

label rangeLabel Range APIs

labels

Label APIs

Label Code Examples

Label APIs

process security attribute flagsProcess Security Attribute Flags APIs

RPCRPC APIs

security APIs from Oracle Solaris OSTrusted Extensions APIs

sensitivity labelSensitivity Label APIs

applications

testing and debuggingDeveloping, Testing, and Debugging an Application

B

bldominates() routine

code exampleDetermining the Relationship Between Two Labels

declarationComparing Labels

blequal() routine

code exampleDetermining the Relationship Between Two Labels

declarationComparing Labels

blinrange() routine

declaration

Comparing Labels

Comparing Labels

blmaximum() routine

declarationComparing Labels

blminimum() routine

declarationComparing Labels

blstrictdom() routine

code exampleDetermining the Relationship Between Two Labels

declarationComparing Labels

brange_t typeLabel APIs

C

classifications

clearance componentClearance Labels

disjointLabel Relationships

dominantLabel Relationships

equalLabel Relationships

label componentSensitivity Labels

strictly dominantLabel Relationships

clearance labelsClearance Labels

clearances

disjoint labelsLabel Relationships

dominant labelsLabel Relationships

equal labelsLabel Relationships

sessionClearance Labels

strictly dominant labelsLabel Relationships

userClearance Labels

code examples

file systems

obtaining labelObtaining a File Label

label relationshipsDetermining the Relationship Between Two Labels

label_encodings file

obtaining character-coded color namesObtaining the Color Names of Labels

labels

obtaining on file systemObtaining a File Label

obtaining process labelObtaining a Process Label

set file sensitivity labelSetting a File Sensitivity Label

communication endpoints

access checksCommunication Endpoints

connections describedBerkeley Sockets and TLI

compartments

clearance componentClearance Labels

disjointLabel Relationships

dominantLabel Relationships

equalLabel Relationships

label componentSensitivity Labels

strictly dominantLabel Relationships

compile

label librariesLabel APIs

D

DAC (discretionary access control)Interprocess Communications

data types

label APIsLabel APIs

debugging

applicationsDeveloping, Testing, and Debugging an Application

definitions of termsUnderstanding Labels

determining whether a system is labeled

exampleDetecting a Trusted Extensions System

disjoint labelsLabel Relationships

dominant labels

Label Relationships

Label Relationships

downgrading labels

guidelinesPrivileged Operations and Labels

privileges neededPrivileged Operations and Labels

E

equal labelsLabel Relationships

examples of Trusted Extensions APIs in Oracle SolarisUnderstanding Labels

F

fgetlabel() system call

declarationObtaining and Setting the Label of a File

file_dac_search privilege

overriding access to parent directory of zone's root directoryWrite-Down Policy in the Global Zone

file_downgrade_sl privilegePrivileged Operations and Labels

file_owner privilegePrivileged Operations and Labels

files

label privilegesPrivileged Operations and Labels

G

getdevicerange() routine

declarationObtaining Label Ranges

getlabel() system call

code exampleObtaining a File Label

declarationObtaining and Setting the Label of a File

getlabel commandSetting a File Sensitivity Label

code exampleDetermining the Relationship Between Two Labels

getpathbylabel() routine

declarationAccessing Labels in Zones

getplabel() routine

code example

Obtaining the Color Names of Labels

Determining the Relationship Between Two Labels

Obtaining a Process Label

declarationAccessing the Process Sensitivity Label

getuserrange() routine

declarationObtaining Label Ranges

getzoneidbylabel() routine

declarationAccessing Labels in Zones

getzonelabelbyid() routine

declarationAccessing Labels in Zones

getzonelabelbyname() routine

declarationAccessing Labels in Zones

getzonerootbyid() routine

declarationAccessing Labels in Zones

getzonerootbylabel() routine

declarationAccessing Labels in Zones

getzonerootbyname() routine

declarationAccessing Labels in Zones

global zone

controlling multilevel operationsMultilevel Operations

labels inLabels in the Global Zone

mounts inWrite-Down Policy in the Global Zone

H

header files

label APIsLabel APIs

locations, list ofHeader File Locations

I

interface names

abbreviations used inAbbreviations Used in Interface Names and Data Structure Names

IPC (interprocess communication)Interprocess Communications

is_system_labeled() routine

declarationDetecting a Trusted Extensions System

L

label APIs

descriptionsLabel APIs

for zone labels and zone pathsLabeled Zones

introduction toSensitivity Labels

labels

code examplesLabel Code Examples

list ofLabel APIs

RPCRPC APIs

label data types

label rangesLabel APIs

sensitivity labelsLabel APIs

label rangesLabel Ranges

file systems

data structureLabel APIs

overviewLabel APIs

label_encodings file

API declarationsLabel APIs

color namesObtaining the Color Names of Labels

label_to_str() routine

code exampleObtaining the Color Names of Labels

labeled zonesLabeled Zones

labeling_disable() routine

declarationEnabling and Disabling a Trusted Extensions System

labeling_enable() routine

declarationEnabling and Disabling a Trusted Extensions System

labeling_set_encodings() routine

declarationSetting the Label Encodings File

labels

acquiringAcquiring a Sensitivity Label

ADMIN_HIGHLabels in the Global Zone

ADMIN_LOWLabels in the Global Zone

API declarationsLabel APIs

disablingLabel APIs

enablingLabel APIs

label_encodings fileLabel APIs

labelsLabel APIs

levelsLabel APIs

network databasesLabel APIs

rangesLabel APIs

zonesLabel APIs

components ofSensitivity Labels

definition ofLabel Relationships

disjointLabel Relationships

dominantLabel Relationships

downgrading guidelinesPrivileged Operations and Labels

in global zoneLabels in the Global Zone

objects

Acquiring a Sensitivity Label

Obtaining and Setting the Label of a File

privileged tasksPrivileged Operations and Labels

privileges

downgrading labelsPrivileged Operations and Labels

upgrading labelsPrivileged Operations and Labels

ranges

Label APIs

Label Range APIs

relationships

Determining the Relationship Between Two Labels

Label Relationships

strictly dominantLabel Relationships

types

clearanceClearance Labels

sensitivitySensitivity Labels

upgrading guidelinesPrivileged Operations and Labels

user processesAcquiring a Sensitivity Label

libraries, compile

label APIsLabel APIs

library routines

API declarationsSystem Calls and Library Routines in Trusted Extensions

bldominates()Comparing Labels

blequal()Comparing Labels

blinrange()

Comparing Labels

Comparing Labels

blmaximum()Comparing Labels

blminimum()Comparing Labels

blstrictdom()Comparing Labels

getdevicerange()Obtaining Label Ranges

getpathbylabel()Accessing Labels in Zones

getplabel()Accessing the Process Sensitivity Label

getuserrange()Obtaining Label Ranges

getzoneidbylabel()Accessing Labels in Zones

getzonelabelbyid()Accessing Labels in Zones

getzonelabelbyname()Accessing Labels in Zones

getzonerootbyid()Accessing Labels in Zones

getzonerootbylabel()Accessing Labels in Zones

getzonerootbyname()Accessing Labels in Zones

is_system_labeled()Detecting a Trusted Extensions System

label_to_str()

Label Encodings File

Readable Versions of Labels

Translating Between Labels and Strings

labeling_disable()Enabling and Disabling a Trusted Extensions System

labeling_enable()Enabling and Disabling a Trusted Extensions System

labeling_set_encodings()Setting the Label Encodings File

m_label_alloc()Allocating and Freeing Memory for Labels

m_label_dup()Allocating and Freeing Memory for Labels

m_label_free()Allocating and Freeing Memory for Labels

setflabel()Obtaining and Setting the Label of a File

str_to_label()Translating Between Labels and Strings

tsol_getrhtype()Obtaining the Remote Host Type

ucred_getlabel()Accessing the Process Sensitivity Label

M

m_label_alloc() routine

code exampleDetermining the Relationship Between Two Labels

declarationAllocating and Freeing Memory for Labels

m_label_dup() routine

declarationAllocating and Freeing Memory for Labels

m_label_free() routine

declarationAllocating and Freeing Memory for Labels

m_label_t typeLabel APIs

MAC (mandatory access control)Interprocess Communications

making socket exempt fromMAC-Exempt Sockets

multilevel operations

security policy forMultilevel Operations

multilevel ports

description of

Multilevel Port Information

Multilevel Port Information

Multilevel Ports

using with UDPUsing Multilevel Ports With UDP

N

net_bindmlp privilegeMultilevel Port Information

net_mac_aware privilegeMAC-Exempt Sockets

network security policy

defaultDefault Network Policy

networks

security attributesMultilevel Ports

non-global zonesLabeled Zones

O

Oracle Solaris

examples of Trusted Extensions APIsUnderstanding Labels

interfaces, API declarationsOracle Solaris Library Routines and System Calls That Use Trusted Extensions Parameters

P

PORTMAPPER serviceRPC Mechanism

ports

multilevelMultilevel Port Information

single-levelMultilevel Port Information

privileged tasks

labelsPrivileged Operations and Labels

multilevel port connectionsMultilevel Port Information

privileges

file_dac_readPrivileged Operations and Labels

file_dac_search

Privileged Operations and Labels

Write-Down Policy in the Global Zone

file_dac_writePrivileged Operations and Labels

file_downgrade_sl

Privileged Operations and Labels

Labeled Zones

file_ownerPrivileged Operations and Labels

file_upgrade_sl

Privileged Operations and Labels

Labeled Zones

net_bindmlp

AF_UNIX Family

Multilevel Port Information

Multilevel Ports

net_mac_aware

MAC-Exempt Sockets

MAC-Exempt Sockets

sys_trans_labelPrivileged Operations and Labels

process clearances

labels definedLabel Relationships

processes

binding to multilevel portsMultilevel Ports

in labeled zonesLabeled Zones

multilevel initiated in global zoneMultilevel Operations

writing down from global zoneWrite-Down Policy in the Global Zone

R

relationships between labelsLabel Relationships

remote host

typeObtaining the Remote Host Type

RPC (remote procedure call)RPC Mechanism

S

SCM_UCREDUsing Multilevel Ports With UDP

security attribute flags

API declarationsProcess Security Attribute Flags APIs

security attributes

accessing labelsPrivileged Operations and Labels

labels from remote hostsMultilevel Ports

security policy

communication endpointsCommunication Endpoints

definition ofUnderstanding Labels

global zoneLabels in the Global Zone

label guidelinesPrivileged Operations and Labels

labelsPrivileged Operations and Labels

multilevel operationsMultilevel Operations

multilevel portsMultilevel Port Information

networkDefault Network Policy

socketsAF_UNIX Family

translating labelsPrivileged Operations and Labels

write-down in global zoneWrite-Down Policy in the Global Zone

sensitivity labels

Sensitivity Labels

Sensitivity Labels

setflabel() routine

code exampleSetting a File Sensitivity Label

declarationObtaining and Setting the Label of a File

setpflags() system callMAC-Exempt Sockets

single-level ports

description ofMultilevel Port Information

SO_MAC_EXEMPT optionMAC-Exempt Sockets

SO_RECVUCRED optionMultilevel Ports

sockets

access checksCommunication Endpoints

exempt from MACMAC-Exempt Sockets

SOL_SOCKETUsing Multilevel Ports With UDP

str_to_label() routine

code exampleSetting a File Sensitivity Label

strictly dominant labelsLabel Relationships

sys_trans_label privilegePrivileged Operations and Labels

system calls

API declarationsSystem Calls and Library Routines in Trusted Extensions

fgetlabel() routineObtaining and Setting the Label of a File

getlabel() routineObtaining and Setting the Label of a File

T

terms

definitions ofUnderstanding Labels

testing and debugging applicationsDeveloping, Testing, and Debugging an Application

text

color namesObtaining the Color Names of Labels

tninfo commandDetecting a Trusted Extensions System

translation

privileges neededPrivileged Operations and Labels

Trusted Extensions APIs

Oracle Solaris examplesUnderstanding Labels

tsol_getrhtype() routine

declarationObtaining the Remote Host Type

U

ucred_getlabel() routine

declarationAccessing the Process Sensitivity Label

upgrading labels

guidelinesPrivileged Operations and Labels

privileges neededPrivileged Operations and Labels

Z

zones

APIs for zone labels and zone pathsLabeled Zones

in Trusted ExtensionsZones and Labels

labeledZones and Labels

mounts and the global zoneWrite-Down Policy in the Global Zone

multilevel portsMultilevel Ports