Common Tasks in Trusted Extensions (Task Map)
The following task map describes procedures that set up a working environment for
administrators of Trusted Extensions.
How to Assign the Editor of Your Choice as the Trusted Editor
The trusted editor uses the value of the $EDITOR environment variable as
its editor.
Before You Begin
You must be in a role in the global zone.
- Determine the value of the $EDITOR variable.
# echo $EDITOR
The following are editor possibilities. The $EDITOR variable might also not be set.
/usr/dt/bin/dtpad – Is the editor that CDE provides.
/usr/bin/gedit – Is the editor that GNOME provides. Trusted GNOME is the trusted version of that desktop.
/usr/bin/vi – Is the visual editor.
- Set the value of the $EDITOR variable.
- To set the value permanently, modify the value in the shell initialization file
for the role.
For example, in the role's home directory, modify the .kshrc file for a
Korn shell, and the .cshrc file for a C shell.
- To set the value for the current shell, set the value in
the terminal window.
For example, in a Korn shell, use the following commands:
# setenv EDITOR=pathname-of-editor
# export $EDITOR
In a C shell, use the following command:
# setenv EDITOR=pathname-of-editor
In a Bourne shell, use the following commands:
# EDITOR=pathname-of-editor
# export EDITOR
Example 11-1 Specifying the Editor for the Trusted Editor
The Security Administrator role wants to use vi when editing system files. A
user who has assumed the role modifies the .kshrc initialization file in
the role's home directory.
$ cd /home/secadmin
$ vi .kshrc
## Interactive shell
set -o vi
...
export EDITOR=vi
The next time that any user assumes the Security Administrator role, vi
is the trusted editor.
How to Change the Password for root
The Security Administrator role is authorized to change any account's password at any
time by using the Solaris Management Console. However, the Solaris Management Console
cannot change the password of a system account. A system account is an account whose
UID is below 100. root is a system account because its UID is
0.
- Become superuser.
If your site has made superuser into the root role, assume the root
role.
- Choose Change Password from the Trusted Path menu.
- Change the password, and confirm the change.
Example 11-2 Changing the Password for a Role
Any user who can assume a role that is defined in LDAP
can use the Trusted Path menu to change the password for the role.
The password is then changed in LDAP for all users who attempt to
assume the role.
As in the Solaris OS, the Primary Administrator role can change the
password for a role by using the Solaris Management Console. In Trusted Extensions,
the Security Administrator role can change another role's password by using the Solaris
Management Console.
How to Regain Control of the Desktop's Current Focus
The “Secure Attention” key combination can be used to break a pointer grab
or a keyboard grab by an untrusted application. The key combination can also
be used to verify if a pointer or a keyboard has been
grabbed by a trusted application. On a multiheaded system that has been spoofed
to display more than one trusted stripe, this key combination warps the pointer
to the authorized trusted stripe.
- To regain control of a Sun keyboard, use the following key combination.
Press the keys simultaneously to regain control of the current desktop focus. On
the Sun keyboard, the diamond is the Meta key.
<Meta> <Stop>
If the grab, such as a pointer, is not trusted, the pointer
moves to the stripe. A trusted pointer does not move to the trusted
stripe.
- If you are not using a Sun keyboard, use the following key
combination.
<Alt> <Break>
Press the keys simultaneously to regain control of the current desktop focus on
your laptop.
Example 11-3 Testing If the Password Prompt Can Be Trusted
On an x86 system that is using a Sun keyboard, the user
has been prompted for a password. The cursor has been grabbed, and is
in the password dialog box. To check that the prompt is trusted, the
user presses the <Meta> <Stop> keys simultaneously. When the pointer remains in the
dialog box, the user knows that the password prompt is trusted.
If the pointer had moved to the trusted stripe, the user would
know that the password prompt could not be trusted, and contact the administrator.
Example 11-4 Forcing the Pointer to the Trusted Stripe
In this example, a user is not running any trusted processes but
cannot see the mouse pointer. To bring the pointer to the center of
the trusted stripe, the user presses the <Meta> <Stop> keys simultaneously.
How to Obtain the Hexadecimal Equivalent for a Label
This procedure provides an internal hexadecimal representation of a label. This representation is
safe for storing in a public directory. For more information, see the atohexlabel(1M)
man page.
Before You Begin
You must be in the Security Administrator role in the global zone.
For details, see How to Enter the Global Zone in Trusted Extensions.
- To obtain a hexadecimal value for a label, do one of the
following.
- To obtain the hexadecimal value for a sensitivity label, pass the label to
the command.
$ atohexlabel "CONFIDENTIAL : NEED TO KNOW"
0x0004-08-68
- To obtain the hexadecimal value for a clearance, use the -c option.
$ atohexlabel -c "CONFIDENTIAL NEED TO KNOW"
0x0004-08-68
Note - Human readable sensitivity labels and clearance labels are formed according to rules in
the label_encodings file. Each type of label uses rules from a separate section
of this file. When a sensitivity label and a clearance label both express
the same underlying level of sensitivity, the labels have identical hexadecimal forms. However,
the labels can have different human readable forms. System interfaces that accept human
readable labels as input expect one type of label. If the text strings
for the label types differ, these text strings cannot be used interchangeably.
In the default label_encodings file, the text equivalent of a clearance label does not
include a colon (:).
Example 11-5 Using the atohexlabel Command
When you pass a valid label in hexadecimal format, the command returns the
argument.
$ atohexlabel 0x0004-08-68
0x0004-08-68
When you pass an administrative label, the command returns the argument.
$ atohexlabel admin_high
ADMIN_HIGH
atohexlabel admin_low
ADMIN_LOW
Troubleshooting
The error message atohexlabel parsing error found in <string> at position 0 indicates that the <string> argument that you passed to
atohexlabel was not a valid label or clearance. Check your typing, and check
that the label exists in your installed label_encodings file.
How to Obtain a Readable Label From Its Hexadecimal Form
This procedure provides a way to repair labels that are stored in
internal databases. For more information, see the hextoalabel(1M) man page.
Before You Begin
You must be in the Security Administrator role in the global zone.
- To obtain the text equivalent for an internal representation of a label, do
one of the following.
How to Change Security Defaults in System Files
In Trusted Extensions, the security administrator changes or accesses default security settings on
a system.
Files in the /etc/security and /etc/default directories contain security settings. On a Solaris
system, superuser can edit these files. For Solaris security information, see Chapter 3, Controlling Access to Systems (Tasks), in System Administration Guide: Security Services.
Caution - Relax system security defaults only if site security policy allows you to.
Before You Begin
You must be in the Security Administrator role in the global zone.
