Solaris Trusted Extensions Administrator's Procedures
Previous Next

Managing Devices in Trusted Extensions (Task Map)

The following task map describes procedures to protect devices at your site.

Task

Description

For Instructions

Set or modify device policy.

Changes the privileges that are required to access a device.

Configuring Device Policy (Task Map) in System Administration Guide: Security Services

Authorize users to allocate a device.

The Security Administrator role assigns a profile with the Allocate Device authorization to the user.

How to Authorize Users to Allocate a Device in System Administration Guide: Security Services

The Security Administrator role assigns a profile with the site-specific authorizations to the user.

Customizing Device Authorizations in Trusted Extensions (Task Map)

Configure a device.

Chooses security features to protect the device.

How to Configure a Device in Trusted Extensions

Revoke or reclaim a device.

Uses the Device Allocation Manager to make a device available for use.

How to Revoke or Reclaim a Device in Trusted Extensions

Uses Solaris commands to make a device available or unavailable for use.

Forcibly Allocating a Device in System Administration Guide: Security Services

Forcibly Deallocating a Device in System Administration Guide: Security Services

Prevent access to an allocatable device.

Provides fine–grained access control to a device.

Example 23-4

Denies everyone access to an allocatable device.

Example 23-1

Protect printers and frame buffers.

Ensures that nonallocatable devices are not allocatable.

How to Protect Nonallocatable Devices in Trusted Extensions

Configure serial login devices.

Enables logins by serial port.

How to Configure a Serial Line for Logins

Enable a CD player program to be used.

Enables an audio player program to open automatically when a music CD is inserted.

How to Configure an Audio Player Program for Use in Trusted CDE

Prevent the File Manager from displaying.

Prevents the File Manager from displaying after a device has been allocated.

How to Prevent the File Manager From Displaying After Device Allocation

Use a new device-clean script.

Places a new script in the appropriate places.

How to Add a Device_Clean Script in Trusted Extensions

How to Configure a Device in Trusted Extensions

By default, an allocatable device has a label range from ADMIN_LOW to ADMIN_HIGH and must be allocated for use. Also, users must be authorized to allocate the device. These defaults can be changed.

Before You Begin

You must be in the Security Administrator role in the global zone.

  1. From the Trusted Path menu, select Allocate Device.

    The Device Allocation Manager appears.


    Dialog box titled Device Allocation Administration shows the default security settings for an audio device for an ordinary user.
  2. View the default security settings.

    Click Device Administration, then highlight the device. The following figure shows a CD-ROM drive with default security settings.


    Dialog box titled Device Allocation Configuration shows the default security settings for a CD-ROM drive.
  3. (Optional) Restrict the label range on the device.
    1. Set the minimum label.

      Click the Min Label... button. Choose a minimum label from the label builder. For information about the label builder, see Label Builder in Trusted Extensions.

    2. Set the maximum label.

      Click the Max Label... button. Choose a maximum label from the label builder.

  4. Specify if the device can be allocated locally.

    In the Device Allocation Configuration dialog box, under For Allocations From Trusted Path, select an option from the Allocatable By list. By default, the Authorized Users option is checked. Therefore, the device is allocatable and users must be authorized.

    • To make the device nonallocatable, click No Users.

      When configuring a printer, frame buffer, or other device that must not be allocatable, select No Users.

    • To make the device allocatable, but to not require authorization, click All Users.
  5. Specify if the device can be allocated remotely.

    In the For Allocations From Non-Trusted Path section, select an option from the Allocatable By list. By default, the Same As Trusted Path option is checked.

    • To require user authorization, select Allocatable by Authorized Users.
    • To make the device nonallocatable by remote users, select No Users.
    • To make the device allocatable by anyone, select All Users.
  6. If the device is allocatable, and your site has created new device authorizations, select the appropriate authorization.

    The following dialog box shows the solaris.device.allocate authorization is required to allocate the cdrom0 device.


    Dialog box titled Device Allocation Authorizations shows the authorizations of a device.

    To create and use site-specific device authorizations, see Customizing Device Authorizations in Trusted Extensions (Task Map).

  7. To save your changes, click OK.

How to Revoke or Reclaim a Device in Trusted Extensions

If a device is not listed in the Device Allocation Manager, it might already be allocated or it might be in an allocate error state. The system administrator can recover the device for use.

Before You Begin

You must be in the System Administrator role in the global zone. This role includes the solaris.device.revoke authorization.

  1. From the Trusted Path menu, select Allocate Device.

    In the following figure, the audio device is already allocated to a user.


    Dialog box titled Device Allocation Administration shows the devices that can be administered, and the allocation status of the audio device.
  2. Click the Device Administration button.
  3. Check the status of a device.

    Select the device name and check the State field.

    • If the State field is Allocate Error State, click the Reclaim button.
    • If the State field is Allocated, do one of the following:
      • Ask the user in the Owner field to deallocate the device.
      • Force deallocation of the device by clicking the Revoke button.
  4. Close the Device Allocation Manager.

How to Protect Nonallocatable Devices in Trusted Extensions

The No Users option in the Allocatable By section of the Device Configuration dialog box is used most often for the frame buffer and printer, which do not have to be allocated to be used.

Before You Begin

You must be in the Security Administrator role in the global zone.

  1. From the Trusted Path menu, select Allocate Device.
  2. In the Device Allocation Manager, click the Device Administration button.
  3. Select the new printer or frame buffer.
    1. To make the device nonallocatable, click No Users.
    2. (Optional) Restrict the label range on the device.
      1. Set the minimum label.

        Click the Min Label... button. Choose a minimum label from the label builder. For information about the label builder, see Label Builder in Trusted Extensions.

      2. Set the maximum label.

        Click the Max Label... button. Choose a maximum label from the label builder.

Example 23-1 Preventing Remote Allocation of the Audio Device

The No Users option in the Allocatable By section prevents remote users from hearing conversations around a remote system.

The security administrator configures the audio device in the Device Allocation Manager as follows:

Device Name: audio
For Allocations From: Trusted Path
Allocatable By: Authorized Users
Authorizations: solaris.device.allocate
Device Name: audio
For Allocations From: Non-Trusted Pathh
Allocatable By: No Users

How to Configure a Serial Line for Logins

Before You Begin

You must be in the Security Administrator role in the global zone.

  1. Open the Solaris Management Console in the Files scope.
    Figure 23-1 Serial Ports Tool in the Solaris Management Console
    Window shows the Navigation pane of the Trusted Extensions toolbox in Files scope. The Devices and Hardware node is visible.
  2. Under Devices and Hardware, navigate to Serial Ports.

    Provide a password when prompted. Follow the online help to configure the serial port.

  3. To change the default label range, open the Device Allocation Manager.

    The default label range is ADMIN_LOW to ADMIN_HIGH.

Example 23-2 Restricting the Label Range of a Serial Port

After creating a serial login device, the security administrator restricts the label range of the serial port to a single label, Public. The administrator sets the following values in the Device Administration dialog boxes.

Device Name: /dev/term/[a|b]
Device Type: tty
Clean Program: /bin/true
Device Map: /dev/term/[a|b]
Minimum Label: Public
Maximum Label: Public
Allocatable By: No Users

How to Configure an Audio Player Program for Use in Trusted CDE

The following procedure enables an audio player to open automatically in a Trusted CDE workspace when a user inserts a music CD. For the user's procedure, see the example in How to Allocate a Device in Trusted Extensions in Solaris Trusted Extensions User’s Guide.


Note - In a Trusted GNOME workspace, users specify the behavior of removable media just as they specify it in a non-trusted workspace.


Before You Begin

You must be in the System Administrator role in the global zone.

  1. Edit the /etc/rmmount.conf file.

    Use the trusted editor. For details, see How to Edit Administrative Files in Trusted Extensions.

  2. Add your site's CD player program to the cdrom action in the file.
    action media action_program.so path-to-program
Example 23-3 Configuring an Audio Player Program for Use

In the following example, the system administrator makes the workman program available to all users of a system. The workman program is an audio player program.

# /etc/rmmount.conf file
action cdrom action_workman.so /usr/local/bin/workman

How to Prevent the File Manager From Displaying After Device Allocation

By default, the File Manager displays when a device is mounted. If you are not mounting devices that have file systems, you might want to prevent the File Manager from displaying.

Before You Begin

You must be in the System Administrator role in the global zone.

  1. Edit the /etc/rmmount.conf file.

    Use the trusted editor. For details, see How to Edit Administrative Files in Trusted Extensions.

  2. Find the following filemgr actions:
    action cdrom action_filemgr.so
    action floppy action_filemgr.so
  3. Comment out the appropriate action.

    The following example shows the action_filemgr.so actions commented out for both the cdrom and diskette devices.

    # action cdrom action_filemgr.so
    # action floppy action_filemgr.so

    When a CDROM or diskette is allocated, the File Manager does not display.

How to Add a Device_Clean Script in Trusted Extensions

If no device_clean script is specified at the time a device is created, the default script, /bin/true, is used.

Before You Begin

Have ready a script that purges all usable data from the physical device and that returns 0 for success. For devices with removable media, the script attempts to eject the media if the user does not do so. The script puts the device into the allocate error state if the medium is not ejected. For details about the requirements, see the device_clean(5) man page.

You must be in the System Administrator role in the global zone.

  1. Copy the script into the /etc/security/lib directory.
  2. In the Device Administration dialog box, specify the full path to the script.
    1. Open the Device Allocation Manager.
    2. Click the Device Administration button.
    3. Select the name of the device, and click the Configure button.
    4. In the Clean Program field, type the full path to the script.
  3. Save your changes.
Previous Next