openSolaris 2008 - Creating Labeled Zones by Using CDE Actions (Task Map) - Solaris Trusted Extensions Administrator's Procedures

Creating Labeled Zones by Using CDE Actions (Task Map)

One zone can be created for every entry in the Trusted Network Zone Configuration database. You made the entries in Specify Zone Names and Zone Labels by Using a CDE Action, by running the Configure Zone action.

The Trusted_Extensions folder in the Application Manager contains the following actions that create labeled zones:

Configure Zone – Creates a zone configuration file for every zone name
Install Zone – Adds the correct packages and file systems to the zone
Zone Terminal Console – Provides a window for viewing events in a zone
Initialize Zone for LDAP – Makes the zone an LDAP client and prepares the zone for booting
Start Zone – Boots the zone, then starts all the service management framework (SMF) services
Shut Down Zone – Changes the state of the zone from Started to Halted

The tasks are completed in the following order.

Task	Description	For Instructions
1. Install and boot one zone.	Create the first labeled zone. Install the packages, make the zone an LDAP client, and start all services in the zone.	Install, Initialize, and Boot a Labeled Zone by Using CDE Actions
2. Customize the zone.	Remove unwanted services. If you plan to copy or clone the zone, remove zone-specific information.	Customize a Booted Zone in Trusted Extensions
3. Create the other zones.	Use one of the following methods to create the other zones. You chose the method in Make System and Security Decisions Before Enabling Trusted Extensions.
	Create each zone from scratch.	Install, Initialize, and Boot a Labeled Zone by Using CDE Actions Resolve Local Zone to Global Zone Routing in Trusted CDE Customize a Booted Zone in Trusted Extensions
	Copy the first labeled zone to another label. Repeat for all zones.	Use the Copy Zone Method in Trusted Extensions
	Use a ZFS snapshot to clone the other zones from the first labeled zone.	Use the Clone Zone Method in Trusted Extensions

Install, Initialize, and Boot a Labeled Zone by Using CDE Actions

Because zone creation involves copying an entire operating system, the process is time-consuming. A faster process is to create one zone, make the zone a template for other zones, and then copy or clone that zone template.

Before You Begin

You have completed Specify Zone Names and Zone Labels by Using a CDE Action.

If you are using LDAP as your naming service, you have completed Make the Global Zone an LDAP Client in Trusted Extensions.

If you are going to clone zones, you have completed Create ZFS Pool for Cloning Zones. In the following procedure, you install the zone that you prepared.

In the Trusted_Extensions folder, double-click the Install Zone action.

Type the name of the zone that you are installing.

This action creates a labeled virtual operating system. This step takes some time to finish. Do not do other tasks on the system while Install Zone is running.

# zone-name: Install Zone
Preparing to install zone <zone-name>
Creating list of files to copy from the global zone
Copying <total> files to the zone
Initializing zone product registry
Determining zone package initialization order.
Preparing to initialize <subtotal> packages on the zone.
Initializing package <number> of <subtotal>: percent complete: percent

Initialized <subtotal> packages on zone.
Zone <zone-name> is initialized.
The file /zone/internal/root/var/sadm/system/logs/install_log 
contains a log of the zone installation.

*** Select Close or Exit from the window menu to close this window ***

Open a console to monitor events in the installed zone.
1. Double-click the Zone Terminal Console action.
2. Type the name of the zone that was just installed.

Initialize the zone.
- If you are using LDAP, double-click the Initialize Zone for LDAP action.
```
Zone name:              Type the name of the installed zone
Host name for the zone: Type the host name for this zone
```
  For example, on a system with a shared logical interface, the values would be similar to the following:
```
Zone name:              public
Host name for the zone: machine1-zones
```
  This action makes the labeled zone an LDAP client of the same LDAP server that serves the global zone. The action is complete when the following information appears:
```
zone-name zone will be  LDAP client of IP-address
zone-name is ready for booting
Zone label is LABEL

*** Select Close or Exit from the window menu to close this window ***
```
- If you are not using LDAP, initialize the zone manually by doing one of the following steps.
  The manual procedure in Trusted Extensions is identical to the procedure for the Solaris OS. If the system has at least one all-zones interface, then the hostname for all the zones must match the global zone's hostname. In general, the answers to the questions during zone initialization are the same as the answers for the global zone.
  Supply the host information by doing one of the following:
  - After you start the zone in Step 3, answer the questions in the Zone Terminal Console about system characteristics.
    Your answers are used to populate the sysidcfg file in the zone.
    
    Note - You must ensure that a route for the Trusted CDE desktop exists from the labeled zone to the global zone. For the procedure, see Resolve Local Zone to Global Zone Routing in Trusted CDE.
  - Place a custom sysidcfg file in the zone's /etc directory before booting the zone in Step 3.

Double-click the Start Zone action.

Answer the prompt.

Zone name: Type the name of the zone that you are configuring

This action boots the zone, then starts all the services that run in the zone. For details about the services, see the smf(5) man page.

The Zone Terminal Console tracks the progress of booting the zone. Messages that are similar to the following appear in the console:

[Connected to zone 'public' console]

[NOTICE: Zone booting up]
...
Hostname: zonename
Loading smf(5) service descriptions: number/total
Creating new rsa public/private host key pair
Creating new dsa public/private host key pair

rebooting system due to change(s) in /etc/default/init

[NOTICE: Zone rebooting]

Monitor the console output.
Before continuing with Customize a Booted Zone in Trusted Extensions, make sure that the zone has rebooted. The following console login prompt indicates that the zone has rebooted.
```
hostname console login:
```

Troubleshooting

For Install Zone: If warnings that are similar to the following are displayed: Installation of these packages generated errors: SUNWpkgname, read the install log and finish installing the packages.

Resolve Local Zone to Global Zone Routing in Trusted CDE

For every zone to access Trusted CDE, the DISPLAY variable must resolve. In Trusted CDE, to resolve the variable, the nodename of the labeled zone, the nodename of the global zone, and the nodename of an all-zones interface must resolve to the identical name.

Before You Begin

You are using Trusted CDEand are manually initializing a labeled zone.

Enable Trusted CDE to display at the label of a zone by using one of the following methods.
- Method 1: Enable X server traffic with other systems.
  In this configuration, the labeled zones can reach other systems through the X server in the global zone.
  1. Ensure that the /etc/nodename file specifies the name of the system.
```
## /etc/nodename
machine1
```
  2. Ensure that the /etc/hosts file specifies the name of the system.
```
## /etc/hosts
192.168.2.3  machine1 loghost
```
    For ToolTalk^TM services to work, the name of the system must be on the same line as loghost.
  3. Ensure that the /etc/hostname.interface file specifies the name of the system.
    In this configuration, machine1 is the all-zones interface for Trusted CDE.
```
## /etc/hostname.bge0
machine1 all-zones
```
- Method 2: Limit X server traffic to the local system.
  In this configuration, the labeled zones can communicate with the X server on the local system. However, no route exists from the local X server to other systems on the network. The route must use another interface.
  1. Ensure that the /etc/nodename file specifies the name of the system.
```
## /etc/nodename
machine1
```
  2. Ensure that the /etc/hosts file specifies the name of the system.
    Starting with the Solaris 10 10/08 release, lo0 is an all-zones interface. In this case, the file appears similar to the following:
```
## /etc/hosts
127.0.0.1  localhost  machine1 loghost
```
    You can also use the vni0 interface.
    For ToolTalk services to work, the name of the system must be on the same line as loghost.
- Method 3: Resolve the DISPLAY variable in another way, such as routable addresses on per-zone logical interfaces.
  For that procedure, see Adding Network Interfaces and Routing to Labeled Zones.
To boot the zone, return to Step 3 in Install, Initialize, and Boot a Labeled Zone by Using CDE Actions.

Customize a Booted Zone in Trusted Extensions

If you are going to clone zones, this procedure configures a zone to be a template for other zones. In addition, this procedure configures the zone for use.

Ensure that the zone has been completely started.
1. In the zone-name: Zone Terminal Console, log in as root.
```
hostname console login: root
Password: Type root password
```
2. Check that the zone is running.
  The status running indicates that at least one process is running in the zone.
```
# zoneadm list -v
ID NAME        STATUS         PATH
 2 public      running        /
```
3. Check that the zone can communicate with the global zone.
  The X server runs in the global zone. Each labeled zone must be able to connect with the global zone to use this service. Therefore, zone networking must work before the zone can be used. For assistance, see Labeled Zone Is Unable to Access the X Server.
In the Zone Terminal Console, disable services that are unnecessary in a labeled zone.
If you are copying or cloning this zone, the services that you disable are disabled in the new zones. The services that are online on your system depend on the service manifest for the zone. Use the netservices limited command to turn off services that labeled zones do not need.
1. Remove many unnecessary services.
```
# netservices limited
```
2. List the remaining services.
```
# svcs
...
STATE        STIME      FMRI
online       13:05:00   svc:/application/graphical-login/cde-login:default
...
```
3. Disable graphical login.
```
# svcadm disable svc:/application/graphical-login/cde-login
# svcs cde-login
STATE        STIME      FMRI
disabled     13:06:22   svc:/application/graphical-login/cde-login:default
```
For information about the service management framework, see the smf(5) man page.
Shut down the zone.
Choose one of the following ways:
- Run the Shut Down Zone action.
  Provide the name of the zone.
- In a terminal window in the global zone, use the zlogin command.
```
# zlogin zone-name init 0
```
  For more information, see the zlogin(1) man page.
Verify that the zone is shut down.
In the zone-name: Zone Terminal Console, the following message indicates that the zone is shut down:
```
[ NOTICE: Zone halted]
```
If you are not copying or cloning this zone, create the remaining zones in the way that you created this first zone.
If you are using this zone as a template for other zones, do the following:
1. Remove the auto_home_zone-name file.
  In a terminal window in the global zone, remove this file from the zone-name zone.
```
cd /zone/zone-name/root/etc
# ls auto_home*
auto_home  auto_home_zone-name
# rm auto_home_zone-name
```
  For example, if the public zone were the basis for cloning other zones, remove its auto_home file:
```
# cd /zone/public/root/etc
# rm auto_home_public
```

Next Steps

If you are copying a zone, go to Use the Copy Zone Method in Trusted Extensions.
If you are cloning a zone, go to Use the Clone Zone Method in Trusted Extensions.

Use the Copy Zone Method in Trusted Extensions

Before You Begin

You have completed Specify Zone Names and Zone Labels by Using a CDE Action.
You have customized a zone that is the template for cloning in Creating Labeled Zones by Using CDE Actions (Task Map).
You are not currently running the zone that is your template for cloning.
The Trusted_Extensions folder is displayed.

For every zone that you want to create, double-click the Copy Zone action.
Answer the prompts.
```
New Zone Name:     Type name of target zone
From Zone Name:    Type name of source zone
```
Caution - Do not perform other tasks while this task is completing.
When the zones are created, check the status of every zone.
1. Double-click the Zone Terminal Console action.
2. Log in to each zone.
3. Complete Verify the Status of the Zone.

Use the Clone Zone Method in Trusted Extensions

Before You Begin

You have completed Specify Zone Names and Zone Labels by Using a CDE Action.
You have completed Create ZFS Pool for Cloning Zones.
You have created the zone template by completing Create ZFS Pool for Cloning Zones.
You have customized a zone that is your template for cloning in Creating Labeled Zones by Using CDE Actions (Task Map).
The zone that is your template for cloning is shut down.
The Trusted_Extensions folder is displayed.

Create a Solaris ZFS snapshot of the zone template.
```
# cd /
# zfs snapshot zone/zone-name@snapshot
```
You use this snapshot to clone the remaining zones. For a configured zone that is named public, the snapshot command is the following:
```
# zfs snapshot zone/public@snapshot
```
For every zone that you want to create, double-click the Clone Zone action.
Answer the prompts.
```
New Zone Name:      Type name of source zone
ZFS Snapshot:         Type name of snapshot
```

Read the information in the dialog box.

Zone label is <LABEL>
zone-name is ready for booting

*** Select Close or Exit from the window menu to close this window ***

For each zone, run the Start Zone action.
Start each zone before running the action for another zone.
After the zones are created, check the status of every zone.
1. Double-click the Zone Terminal Console action.
2. Complete Verify the Status of the Zone.