Developer's Guide to Oracle^® Solaris 11.4 Security

Index

A

access control lists

use in GSS-APIComparing Names in GSS-API

account management

PAM service modulePAM Service Modules

ACL  Seeaccess control list

acquiring context informationObtaining Context Information in GSS-API

adiheap security extensionSecurity Extensions Framework

adistack security extensionSecurity Extensions Framework

anonymous authenticationPerforming Anonymous Authentication in GSS-API

aslr security extensionSecurity Extensions Framework

authentication

GSS-APISecurity Services in GSS-API

anonymousPerforming Anonymous Authentication in GSS-API

mutualPerforming Mutual Authentication Between Peers in GSS-API

PAM process forPAM Authentication Process

PAM service modulePAM Service Modules

authorizations

code exampleChecking for User Authorizations

definedPrivileged Applications

use in application developmentAbout Authorizations

B

basic privilegesPrivilege Categories

C

C_CloseSession() function

digest message exampleMessage Digest Example

message signing exampleSign and Verify Example

random byte generation exampleRandom Byte Generation Example

C_Decrypt() functionSymmetric Encryption Example

C_DecryptInit() functionSymmetric Encryption Example

C_EncryptFinal() functionSymmetric Encryption Example

C_EncryptInit() functionSymmetric Encryption Example

C_EncryptUpdate() functionSymmetric Encryption Example

C_Finalize() function

digest message exampleMessage Digest Example

message signing exampleSign and Verify Example

C_GenerateKeyPair() functionSign and Verify Example

C_GenerateRandom() functionRandom Byte Generation Example

C_GetAttributeValue() functionSign and Verify Example

C_GetInfo() function

Message Digest Example

PKCS #11 Functions: C_GetInfo

C_GetMechanismList() functionPKCS #11 Functions: C_GetMechanismList

C_GetSlotList() functionPKCS #11 Functions: C_GetSlotList

message signing exampleSign and Verify Example

random byte generation exampleRandom Byte Generation Example

C_Initialize() functionPKCS #11 Functions: C_Initialize

C_OpenSession() functionPKCS #11 Functions: C_OpenSession

random byte generation exampleRandom Byte Generation Example

C_SignInit() functionSign and Verify Example

C_Verify() functionSign and Verify Example

C_VerifyInit() functionSign and Verify Example

Certificate Revocation List (CRL)Oracle Solaris Key Management Framework Features

Certificate Signing Request (CSR)KMF Key Management Tool

channel bindings

GSS-API

GSS-API Address Types for Channel Bindings

Using Channel Bindings in GSS-API

client_establish_context() function

GSS-API client exampleEstablishing a Security Context With the Server

confidentiality

GSS-API

Sending Protected Data in GSS-API

Security Services in GSS-API

connect_to_server() function

GSS-API client example

Establishing a Security Context for GSS-API

Opening a Connection With the Server

consumers

Cryptographic FrameworkOracle Solaris Cryptography Terminology

definedNetwork Security Architecture

context-level tokens

GSS-APIGSS-API Tokens

contexts

GSS-API

acceptanceAccepting a Context in GSS-API

acceptance exampleAccepting a Context

deletionCleaning Up a GSS-API Session

establishingWorking With Contexts in GSS-API

establishing exampleEstablishing a Security Context for GSS-API

exportingExporting and Importing Contexts in GSS-API

getting acquisition informationObtaining Context Information in GSS-API

gss-client exampleDeleting the Security Context

import and export

Using the test_import_export_context Function

Exporting and Importing Contexts in GSS-API

introductionGSS-API Layer

other context servicesUsing Other Context Services in GSS-API

releasingCleaning Up the GSSAPI Server Example

initiation in GSS-APIInitiating a Context in GSS-API

createMechOid() functioncreateMechOid Function

credentials

GSS-API

acquiringAcquiring Credentials

defaultAcquiring Credentials in GSS-API

delegatingDelegating a Credential in GSS-API

typesTypes of Credentials That GSS-API Supports

usingWorking With Credentials in GSS-API

CRL (Certificate Revocation List)Oracle Solaris Key Management Framework Features

cryptoadm commandComponents of the Cryptographic Framework

cryptographic checksum (MIC)Tagging Messages With gss_get_mic

Cryptographic Framework

architectureOverview of the Cryptographic Framework

cryptoadm commandComponents of the Cryptographic Framework

cryptographic providersComponents of the Cryptographic Framework

cryptoki libraryOverview of the Cryptoki Library

describedSystem Security

design requirements

user-level consumersRequirements for Developers of User-Level Consumers

user-level providersRequirements for Developers of User-Level Providers

elfsign commandComponents of the Cryptographic Framework

examples

message digestMessage Digest Example

random byte generationRandom Byte Generation Example

signing and verifying messagesSign and Verify Example

symmetric encryptionSymmetric Encryption Example

introductionIntroduction to the Oracle Solaris Cryptographic Framework

kernel programmer interfaceComponents of the Cryptographic Framework

libpkcs11.soComponents of the Cryptographic Framework

modules verification libraryComponents of the Cryptographic Framework

pkcs11_softtoken.soComponents of the Cryptographic Framework

pluggable interfaceComponents of the Cryptographic Framework

scheduler / load balancer

Components of the Cryptographic Framework

Components of the Cryptographic Framework

cryptographic providers

Cryptographic FrameworkComponents of the Cryptographic Framework

cryptoki library

overviewOverview of the Cryptoki Library

CSR (Certificate Signing Request)KMF Key Management Tool

D

data encryption

GSS-APIWrapping Messages With gss_wrap

data protection

GSS-APISending Protected Data in GSS-API

data types

GSS-API

GSS-API Data Types and Values

GSS-API Data Types

integersGSS-API Integers

namesNames in GSS-API

stringsStrings and Similar Data in GSS-API

privilegesPrivilege Data Types

debugging

security extensions andDebugging When Using Security Extensions

default credentials

GSS-APIAcquiring Credentials in GSS-API

delegation

credentialsDelegating a Credential in GSS-API

design requirements

Cryptographic Framework

user-level consumersRequirements for Developers of User-Level Consumers

user-level providersRequirements for Developers of User-Level Providers

digesting messages

Cryptographic FrameworkMessage Digest Example

E

/etc/gss/mech file/etc/gss/mech File

/etc/gss/qop file/etc/gss/qop File

effective privilege setEffective Privilege Set

elfdump commandUsing elfdump and elfedit to Manage Security Extensions in Objects

elfedit commandUsing elfdump and elfedit to Manage Security Extensions in Objects

elfsign commandComponents of the Cryptographic Framework

encryption

GSS-APISending Protected Data in GSS-API

wrapping messages with gss_wrap()Wrapping Messages With gss_wrap

error codes

GSS-APIGSS-API Major Status Code Values

examples

checking for authorizationsChecking for User Authorizations

Cryptographic Framework

message digestMessage Digest Example

random byte generationRandom Byte Generation Example

signing and verifying messagesSign and Verify Example

symmetric encryptionSymmetric Encryption Example

GSS-API client application

descriptionGSSAPI Client Example Overview

source codeClient-Side GSS-API Application

GSS-API miscellaneous functions

source codeMiscellaneous GSS-API Sample Functions

GSS-API server application

descriptionGSSAPI Server Example Overview

source codeServer-Side GSS-API Application

PAM consumer applicationSimple PAM Consumer Example

PAM conversation functionWriting Conversation Functions

PAM service providerSample PAM Provider Service Module

privilege bracketingPrivilege Bracketing in the Least Privilege Model

exporting GSS-API contextsExporting and Importing Contexts in GSS-API

Extended PKCS#11, v2.40 Errata 01  SeePKCS #11

F

functions  Seespecific function name

GSS-APIGSS-API Functions

G

General Security Standard Application Programming Interface  SeeGSS-API

GetMechanismInfo() functionSign and Verify Example

GetRandSlot() functionRandom Byte Generation Example

GetTokenInfo() functionRandom Byte Generation Example

GSS-API

acquiring credentialsAcquiring Credentials

anonymous authenticationPerforming Anonymous Authentication in GSS-API

anonymous name formatGSS-API Format of Anonymous Names

channel bindings

GSS-API Address Types for Channel Bindings

Using Channel Bindings in GSS-API

communication layersIntroduction to GSS-API

comparing names inComparing Names in GSS-API

confidentialitySending Protected Data in GSS-API

constructing OIDsConstructing Mechanism OIDs

context establishment exampleEstablishing a Security Context for GSS-API

contexts

acceptance exampleAccepting a Context

deallocation

Cleaning Up a GSS-API Session

Cleaning Up a GSS-API Session

expirationGSS-API Context Expiration

createMechOid() functioncreateMechOid Function

credentialsWorking With Credentials in GSS-API

expirationCredential Expiration in GSS-API

data types

GSS-API Data Types and Values

GSS-API Data Types

describedNetwork Security Architecture

detecting out-of-sequence problemsDetecting Sequence Problems in GSS-API

developing applicationsDeveloping Applications That Use GSS-API

displaying status codesDisplaying GSS-API Status Codes

encryption

Wrapping Messages With gss_wrap

Sending Protected Data in GSS-API

exporting contexts

GSS-API Context Exportation and Interprocess Tokens

Exporting and Importing Contexts in GSS-API

files containing OID valuesFiles with OID Values

functionsGSS-API Functions

generalized stepsGeneralized GSS-API Usage

gss-client example

context deletionDeleting the Security Context

contextsMiscellaneous GSSAPI Context Operations on the Client Side

sending messagesWrapping and Sending a Message

signature blocksReading and Verifying a Signature Block From a GSS-API Client

gss-server example

signing messagesSigning and Returning the Message

unwrapping messagesUnwrapping the Message

gss_str_to_oid() functiongss_str_to_oid Function

include filesGeneralized GSS-API Usage

integritySending Protected Data in GSS-API

interprocess tokensGSS-API Context Exportation and Interprocess Tokens

introductionIntroduction to GSS-API

Kerberos v5 status codesKerberos v5 Status Codes

language bindingsLanguage Bindings for GSS-API

limitationsLimitations of GSS-API

mech file/etc/gss/mech File

message transmissionConfirming Message Transmission in GSS-API

MICsSending Protected Data in GSS-API

minor-status codesUse of minor_status Parameter in GSS-API

miscellaneous sample functions

source codeMiscellaneous GSS-API Sample Functions

mutual authenticationPerforming Mutual Authentication Between Peers in GSS-API

name types

GSS-API Name Types

Name Types in GSS-API

OIDsGSS-API OIDs

other context servicesUsing Other Context Services in GSS-API

outside referencesWhere to Get More Information on GSS-API

portabilityApplication Portability With GSS-API

protecting channel-binding informationProtection of GSS-API Channel-Binding Information

QOP

/etc/gss/qop File

Application Portability With GSS-API

readable name syntaxHuman-Readable GSS-API Name Syntax

releasing contextsCleaning Up the GSSAPI Server Example

releasing stored dataDeletion of GSS-API Contexts and Stored Data

remote procedure callsRemote Procedure Calls With GSS-API

replaced functionsFunctions From Previous Versions of GSS-API

sample client application

descriptionGSSAPI Client Example Overview

source codeClient-Side GSS-API Application

sample server application

descriptionGSSAPI Server Example Overview

source codeServer-Side GSS-API Application

specifying non-default mechanismsSpecifying a Non-Default Mechanism

specifying OIDsSpecifying an OID

status code macrosGSS-API Status Code Macros

status codes

GSS-API Major Status Code Values

GSS-API Status Codes

GSS-API Status Codes

supported credentialsTypes of Credentials That GSS-API Supports

tokensGSS-API Tokens

context-levelGSS-API Tokens

interprocessInterprocess Tokens in GSS-API

per-messageGSS-API Tokens

translation into GSS-API formatTranslating a Service Name into GSS-API Format

wrap-size limitsGSS-API Wrap Size Limits and QOP Values

gss-client example

context deletionDeleting the Security Context

obtaining context statusMiscellaneous GSSAPI Context Operations on the Client Side

restoring contextsMiscellaneous GSSAPI Context Operations on the Client Side

saving contextsMiscellaneous GSSAPI Context Operations on the Client Side

sending messagesWrapping and Sending a Message

signature blocksReading and Verifying a Signature Block From a GSS-API Client

gss-client sample applicationGSSAPI Client Example Overview

gss-server example

signing messagesSigning and Returning the Message

unwrapping messagesUnwrapping the Message

gss-server sample applicationGSSAPI Server Example Overview

gss_accept_sec_context() functionGSS-API Functions

gss_accept_sec_context() functionAccepting a Context in GSS-API

GSS-API server exampleGSSAPI Server server_establish_context Function

gss_acquire_cred() functionGSS-API Functions

gss_acquire_cred() functionAcquiring Credentials in GSS-API

GSS-API server exampleAcquiring Credentials

gss_add_cred() functionGSS-API Functions

gss_add_cred() functionAcquiring Credentials in GSS-API

gss_add_oid_set_member() functionGSS-API Functions

gss_buffer_desc structuregss_buffer_desc Data Type

gss_buffer_desc structureStrings and Similar Data in GSS-API

gss_buffer_t pointerStrings and Similar Data in GSS-API

GSS_C_ACCEPT credentialWorking With Credentials in GSS-API

GSS_C_BOTH credentialWorking With Credentials in GSS-API

GSS_C_INITIATE credentialWorking With Credentials in GSS-API

GSS_CALLING_ERROR macro

GSS-API Status Code Macros

GSS-API Status Codes

gss_canonicalize_name() functionGSS-API Functions

gss_canonicalize_name() functionUsing gss_import_name

gss_channel_bindings_structure structuregss_channel_bindings_struct Data Type

gss_channel_bindings_t data typeUsing Channel Bindings in GSS-API

gss_compare_name() functionGSS-API Functions

gss_compare_name() function

Comparing GSSAPI Names (Slow)

Comparing Names in GSS-API

gss_context_time() functionGSS-API Functions

gss_create_empty_oid_set() functionGSS-API Functions

gss_delete_oid() functionFunctions for Manipulating OIDs

gss_delete_sec_context() functionGSS-API Functions

gss_delete_sec_context() functionCleaning Up a GSS-API Session

releasing contextsDeletion of GSS-API Contexts and Stored Data

gss_display_name() functionGSS-API Functions

gss_display_name() functionUsing gss_import_name

gss_display_status() functionGSS-API Functions

gss_display_status() functionDisplaying GSS-API Status Codes

gss_duplicate_name() functionGSS-API Functions

gss_export_context() functionInterprocess Tokens in GSS-API

gss_export_name() functionGSS-API Functions

gss_export_sec_context() functionGSS-API Functions

gss_export_sec_context() functionExporting and Importing Contexts in GSS-API

gss_get_mic() functionGSS-API Functions

gss_get_mic() function

Tagging Messages With gss_get_mic

Sending Protected Data in GSS-API

comparison with gss_wrap()functionSending Protected Data in GSS-API

GSS-API server exampleSigning and Returning the Message

gss_import_name() functionGSS-API Functions

gss_import_name() functionNames in GSS-API

GSS-API client exampleTranslating a Service Name into GSS-API Format

GSS-API server exampleAcquiring Credentials

gss_import_sec_context() functionGSS-API Functions

gss_import_sec_context() functionExporting and Importing Contexts in GSS-API

gss_indicate_mechs() functionGSS-API Functions

gss_init_sec_context() functionGSS-API Functions

gss_init_sec_context() function

Using Other Context Services in GSS-API

Initiating a Context in GSS-API

GSS-API client exampleEstablishing a Security Context for GSS-API

use in anonymous authenticationPerforming Anonymous Authentication in GSS-API

use in mutual authenticationPerforming Mutual Authentication Between Peers in GSS-API

gss_inquire_context() functionGSS-API Functions

gss_inquire_context() functionObtaining Context Information in GSS-API

gss_inquire_cred() functionGSS-API Functions

gss_inquire_cred_by_mech() functionGSS-API Functions

gss_inquire_mechs_for_name() functionGSS-API Functions

gss_inquire_names_for_mech() functionGSS-API Functions

gss_OID pointerGSS-API OIDs

gss_OID_desc structuregss_OID_desc Data Type

gss_OID_set pointerOIDs Structure

gss_OID_set_desc structuregss_OID_set_desc Data Type

gss_OID_set_desc structureOIDs Structure

gss_oid_to_str() functionFunctions for Manipulating OIDs

gss_process_context_token() functionGSS-API Functions

gss_release_buffer() functionGSS-API Functions

gss_release_buffer() functionCleaning Up a GSS-API Session

gss_release_cred() functionGSS-API Functions

gss_release_cred() functionCleaning Up a GSS-API Session

GSS-API server exampleCleaning Up the GSSAPI Server Example

gss_release_name() functionGSS-API Functions

gss_release_name() functionCleaning Up a GSS-API Session

releasing stored dataDeletion of GSS-API Contexts and Stored Data

gss_release_oid() function

GSS-API client exampleGSSAPI Client Example: main Function

GSS-API server exampleAcquiring Credentials

gss_release_oid_set() functionGSS-API Functions

gss_release_oid_set() functionCleaning Up a GSS-API Session

GSS_ROUTINE_ERROR macro

GSS-API Status Code Macros

GSS-API Status Codes

gss_seal() functionRenamed GSS-API Functions

gss_sign() functionRenamed GSS-API Functions

gss_str_to_oid() function

gss_str_to_oid Function

Functions for Manipulating OIDs

GSS_SUPPLEMENTARY_INFO macro

GSS-API Status Code Macros

GSS-API Status Codes

gss_test_oid_set_member() functionGSS-API Functions

gss_unseal() functionRenamed GSS-API Functions

gss_unwrap() functionGSS-API Functions

gss_unwrap() function

GSS-API server exampleUnwrapping the Message

gss_verify() functionRenamed GSS-API Functions

gss_verify_mic() functionGSS-API Functions

gss_wrap() function

comparison with gss_get_mic()Sending Protected Data in GSS-API

message encryption andSending Protected Data in GSS-API

size issuesHandling Wrap Size Issues in GSS-API

wrapping messagesWrapping Messages With gss_wrap

gss_wrap()function

describingGSS-API Functions

gss_wrap_size_limit() functionGSS-API Functions

gss_wrap_size_limit() functionHandling Wrap Size Issues in GSS-API

gssapi.h fileGeneralized GSS-API Usage

guidelines for privileged applicationsGuidelines for Developing Privileged Applications

H

header files

GSS-APIGeneralized GSS-API Usage

I

importing GSS-API contextsExporting and Importing Contexts in GSS-API

inetd

checking for in gss-client() exampleChecking for inetd

inheritable privilege setInheritable Privilege Set

integers

GSS-APIGSS-API Integers

integrity

GSS-API

Sending Protected Data in GSS-API

Security Services in GSS-API

interprocess tokens

GSS-APIInterprocess Tokens in GSS-API

J

Java APISystem Security

K

kadi security extensionSecurity Extensions Framework

Kerberos v5

GSS-APIAvailable Mechanisms in GSS-API

key managementSystem Security

Key Management Framework (KMF)Introduction to the Oracle Solaris Key Management Framework

keypairKMF Application Programming Interfaces

keystoreOracle Solaris Key Management Framework Features

KMF (Key Management Framework)Introduction to the Oracle Solaris Key Management Framework

kmfcfg commandKMF Policy Enforcement Mechanisms

L

language bindings

GSS-APILanguage Bindings for GSS-API

libpam libraryPAM Library

libpkcs11.so library

Cryptographic FrameworkComponents of the Cryptographic Framework

libraries

cryptokiOverview of the Cryptoki Library

libpamPAM Library

libpkcs11Components of the Cryptographic Framework

pkcs11_softtokenComponents of the Cryptographic Framework

limit privilege setLimit Privilege Set

M

macros

GSS-APIGSS-API Status Codes

major status codes

GSS-APIGSS-API Status Codes

descriptionsGSS-API Major Status Code Values

mech file/etc/gss/mech File

Mechanism Name (MN)Using gss_import_name

mechanisms

Cryptographic FrameworkOracle Solaris Cryptography Terminology

definedNetwork Security Architecture

GSS-APIAvailable Mechanisms in GSS-API

printable formatsgss_str_to_oid Function

specifying GSS-APIMechanisms and QOPs in GSS-API

memcmp functionComparing GSSAPI Names (Slow)

message digesting

Cryptographic FrameworkMessage Digest Example

Message Integrity Code  SeeMICs

messages  See Alsodata

encrypting with gss_wrap()Wrapping Messages With gss_wrap

GSS-APIGSS-API Tokens

out-of-sequence problemsDetecting Sequence Problems in GSS-API

sendingWrapping and Sending a Message

signingSigning and Returning the Message

transmission confirmationConfirming Message Transmission in GSS-API

unwrappingUnwrapping the Message

tagging with MICsTagging Messages With gss_get_mic

wrapping in GSS-APIHandling Wrap Size Issues in GSS-API

metaslot

Cryptographic FrameworkOracle Solaris Cryptography Terminology

MICs

definedSending Protected Data in GSS-API

GSS-API

tagging messagesTagging Messages With gss_get_mic

message transmission confirmationConfirming Message Transmission in GSS-API

minor status codes

GSS-APIGSS-API Status Codes

MN  SeeMechanism Name

mutual authentication

GSS-APIPerforming Mutual Authentication Between Peers in GSS-API

N

name types

GSS-APIGSS-API Name Types

names

comparing in GSS-APIComparing Names in GSS-API

GSS-APINames in GSS-API

types in GSS-APIName Types in GSS-API

network security

overviewNetwork Security Architecture

nxheap security extensionSecurity Extensions Framework

nxstack security extensionSecurity Extensions Framework

O

Object Identifiers  SeeOIDs

OCSP (Online Certificate Status Protocol)Oracle Solaris Key Management Framework Features

OIDs

constructingConstructing Mechanism OIDs

deallocation ofOID Set Structure

GSS-APIGSS-API OIDs

setsOIDs Structure

specifying

Specifying an OID

Mechanisms and QOPs in GSS-API

types of data stored asGSS-API OIDs

Online Certificate Status Protocol (OCSP)Oracle Solaris Key Management Framework Features

Oracle Solaris cryptographic framework  SeeCryptographic Framework

out-of-sequence problems

GSS-APIDetecting Sequence Problems in GSS-API

P

PAM

authentication processPAM Authentication Process

consumer application exampleSimple PAM Consumer Example

describedNetwork Security Architecture

frameworkIntroduction to the PAM Framework

itemsRequirements for PAM Consumers

libraryPAM Library

requirements for PAM consumersRequirements for PAM Consumers

service modulesPAM Service Modules

service provider exampleSample PAM Provider Service Module

service provider requirementsRequirements for PAM Service Providers

writing applications and servicesWriting PAM Applications and Services

writing conversation functionsWriting Conversation Functions

pam.conf file  SeePAM configuration file

pam_end() functionRequirements for PAM Consumers

pam_getenvlist() functionUseful PAM Functions

pam_open_session() functionUseful PAM Functions

pam_set_item() functionRequirements for PAM Consumers

pam_setcred() functionSimple PAM Consumer Example

pam_start() functionRequirements for PAM Consumers

parse_oid() functionSpecifying a Non-Default Mechanism

GSS-API client exampleGSSAPI Client Example: main Function

per-message tokens

GSS-APIGSS-API Tokens

permitted privilege setPermitted Privilege Set

PKCS #11

C_GetInfo() functionPKCS #11 Functions: C_GetInfo

C_GetMechanismList() functionPKCS #11 Functions: C_GetMechanismList

C_GetSlotList() functionPKCS #11 Functions: C_GetSlotList

C_GetTokenInfo() functionPKCS #11 Functions: C_GetTokenInfo

C_Initialize() functionPKCS #11 Functions: C_Initialize

C_OpenSession() functionPKCS #11 Functions: C_OpenSession

Extended PKCS#11, v2.40 Errata 01System Security

function listPKCS #11 Function List

pkcs11_softtoken.so moduleOverview of the Cryptoki Library

SUNW_C_GetMechSession() function

SUNW_C_KeyToObject Extended PKCS #11 Function

SUNW_C_GetMechSession Extended PKCS #11 Function

pkcs11_softtoken.so library

Cryptographic FrameworkComponents of the Cryptographic Framework

PKI (Public Key Infrastructure)Introduction to the Oracle Solaris Key Management Framework

pktool key management toolKMF Key Management Tool

pluggable authentication module  SeePAM

pluggable interface

Cryptographic FrameworkComponents of the Cryptographic Framework

plugins

Cryptographic FrameworkOracle Solaris Cryptography Terminology

principals

GSS-APINames in GSS-API

PRIV_DAX_ACCESS basic privilegePrivilege Categories

PRIV_FILE_LINK_ANY basic privilegePrivilege Categories

PRIV_FILE_READ basic privilegePrivilege Categories

PRIV_FILE_WRITE basic privilegePrivilege Categories

PRIV_NET_ACCESS basic privilegePrivilege Categories

PRIV_OFF flagPrivilege Data Types

PRIV_ON flagPrivilege Data Types

PRIV_PROC_EXEC basic privilegePrivilege Categories

PRIV_PROC_FORK basic privilegePrivilege Categories

PRIV_PROC_INFO basic privilegePrivilege Categories

PRIV_PROC_SELF basic privilegePrivilege Categories

PRIV_PROC_SESSION basic privilegePrivilege Categories

PRIV_SET flagPrivilege Data Types

priv_set_t structurePrivilege Data Types

priv_str_to_set() functionpriv_str_to_set for Mapping Privileges

PRIV_SYS_IB_INFO basic privilegePrivilege Categories

priv_t typePrivilege Data Types

privilege setsHow Privileges Are Implemented

privileged applicationsDeveloping Privileged Applications

privileges

assignmentHow Administrators Assign Privileges

basicPrivilege Categories

bracketing in the least privilege modelPrivilege Bracketing in the Least Privilege Model

bracketing in the superuser modelPrivilege Bracketing in the Superuser Model

categoriesPrivilege Categories

code examplePrivilege Bracketing in the Least Privilege Model

compatibility with superuserCompatibility Between the Superuser and Privilege Models

data typesPrivilege Data Types

definedPrivileged Applications

interfacesPrivilege Interfaces

introductionSystem Security

not basicPrivilege Categories

operation flagsPrivilege Data Types

overviewAbout Privileges

priv_str_to_set() functionpriv_str_to_set for Mapping Privileges

privilege ID data typePrivilege Data Types

required header fileProgramming with Privileges

setppriv() functionsetppriv for Setting Privileges

use in application developmentGuidelines for Developing Privileged Applications

process privileges  Seeprivileges

protecting data

GSS-APISending Protected Data in GSS-API

providers

Cryptographic Framework

Components of the Cryptographic Framework

Oracle Solaris Cryptography Terminology

definedNetwork Security Architecture

Public Key Infrastructure (PKI)Introduction to the Oracle Solaris Key Management Framework

Q

QOP

GSS-API andApplication Portability With GSS-API

role in wrap sizeHandling Wrap Size Issues in GSS-API

specifying

Files with OID Values

Mechanisms and QOPs in GSS-API

storage in OIDsGSS-API OIDs

qop file/etc/gss/qop File

Quality of Protection  SeeQOP

R

random byte generation

Cryptographic Framework

exampleRandom Byte Generation Example

remote procedure calls

GSS-APIRemote Procedure Calls With GSS-API

return codes

GSS-APIGSS-API Status Codes

RPCSEC_GSSRemote Procedure Calls With GSS-API

S

SASLNetwork Security Architecture

SEAM (obsolete)  SeeKerberos v5

security context  Seecontexts

security extensions

kernelSecurity Extensions Framework

security mechanisms  SeeGSS-API

security policy

privileged application guidelinesGuidelines for Developing Privileged Applications

send_token() function

GSS-API client exampleEstablishing a Security Context for GSS-API

sequence problems

GSS-APIDetecting Sequence Problems in GSS-API

server_acquire_creds() function

GSS-API server exampleAcquiring Credentials

server_establish_context() function

GSS-API server exampleAccepting a Context

session management

PAM service modulePAM Service Modules

session objects

Cryptographic FrameworkOracle Solaris Cryptography Terminology

setppriv() functionsetppriv for Setting Privileges

shell escapes

privileges andGuidelines for Developing Privileged Applications

sign_server() function

GSS-API client exampleGSSAPI Server Example: main Function

GSS-API server exampleReceiving Data From a Client

signature blocks

GSS-API

gss-client exampleReading and Verifying a Signature Block From a GSS-API Client

signing messages

GSS-APISigning and Returning the Message

signing messages example

Cryptographic FrameworkSign and Verify Example

slots

Cryptographic FrameworkOracle Solaris Cryptography Terminology

soft tokens

Cryptographic FrameworkOracle Solaris Cryptography Terminology

specifying a QOPFiles with OID Values

specifying mechanisms in GSS-APIFiles with OID Values

specifying OIDsSpecifying an OID

SPI

Cryptographic Framework

user levelComponents of the Cryptographic Framework

status codes

GSS-API

GSS-API Status Codes

GSS-API Status Codes

majorGSS-API Status Codes

minorGSS-API Status Codes

strings

GSS-APIStrings and Similar Data in GSS-API

SUNW_C_GetMechSession() function

digest message exampleMessage Digest Example

symmetric encryption exampleSymmetric Encryption Example

SUNW_C_GetMechSession() function

SUNW_C_KeyToObject Extended PKCS #11 Function

SUNW_C_GetMechSession Extended PKCS #11 Function

sxadm commandUsing the sxadm Command to Manage Security Extensions

symmetric encryption

Cryptographic Framework

exampleSymmetric Encryption Example

T

test_import_export_context() function

GSS-API server exampleUsing the test_import_export_context Function

token objects

Cryptographic FrameworkOracle Solaris Cryptography Terminology

tokens

Cryptographic FrameworkOracle Solaris Cryptography Terminology

distinguishing GSS-API typesGSS-API Tokens

GSS-API

context-levelGSS-API Tokens

interprocessInterprocess Tokens in GSS-API

per-messageGSS-API Tokens

V

verifying messages example

Cryptographic Framework

exampleSign and Verify Example

W

wrapping messages

GSS-APIHandling Wrap Size Issues in GSS-API