tnchkdb(1m) [opensolaris man page]
tnchkdb(1M) System Administration Commands tnchkdb(1M) NAME
tnchkdb - check file syntax of trusted network databases SYNOPSIS
/usr/sbin/tnchkdb [-h path] [-t path] [-z path] DESCRIPTION
tnchkdb checks the syntax of the tnrhtp, tnrhdb, and tnzonecfg databases. By default, the path for each file is: o /etc/security/tsol/tnrhtp o /etc/security/tsol/tnrhdb o /etc/security/tsol/tnzonecfg You can specify an alternate path for any or all of the files by specifying that path on the command line by using the -h (tnrhdb), -t (tnrhtp) and -z (tnzonecfg) options. The options are useful when testing a set of modified files before installing the files as new system databases. All three database files are checked for integrity. tnchkdb returns an exit status of 0 if all of the files are syntactically and, to the extent possible, semantically correct. If one or more files have errors, then an exit status of 1 is returned. If there are command line problems, such as an unreadable file, an exit status of 2 is returned. Errors are written to standard error. To avoid cascading errors, when there are errors in tnrhtp, the template names in tnrhdb are not validated. tnchkdb can be run at any label, but the standard /etc/security/tsol files are visible only in the global zone. OPTIONS
-h [ path ] Check path for proper tnrhdb syntax. If path is not specified, then check /etc/security/tsol/tnrhdb. -t [ path ] Check path for proper tnrhtp syntax. If path is not specified, then check /etc/security/tsol/tnrhtp. -z [ path ] Check path for proper tnzonecfg syntax. If path is not specified, then check /etc/security/tsol/tnzonecfg. EXAMPLES
Example 1 Sample Error Message The tnchkdb command checks for CIPSO errors. In this example, the admin_low template has an incorrect value of ADMIN_HIGH for its default label. # tnchkdb checking /etc/security/tsol/tnrhtp ... tnchkdb: def_label classification 7fff is invalid for cipso labels: line 14 entry admin_low tnchkdb: def_label compartments 241-256 must be zero for cipso labels: line 14 entry admin_low checking /etc/security/tsol/tnrhdb ... checking /etc/security/tsol/tnzonecfg ... FILES
/etc/security/tsol/tnrhdb Trusted network remote-host database /etc/security/tsol/tnrhtp Trusted network remote-host templates /etc/security/tsol/tnzonecfg Trusted zone configuration database ATTRIBUTES
See attributes(5) for descriptions of the following attributes: +-----------------------------+-----------------------------+ | ATTRIBUTE TYPE | ATTRIBUTE VALUE | +-----------------------------+-----------------------------+ |Availability |SUNWtsu | +-----------------------------+-----------------------------+ |Interface Stability |See below. | +-----------------------------+-----------------------------+ The command line is Committed. The output is Uncommitted. SEE ALSO
tnd(1M), tnctl(1M), attributes(5) How to Check the Syntax of Trusted Network Databases in Solaris Trusted Extensions Administrator's Procedures NOTES
The functionality described on this manual page is available only if the system is configured with Trusted Extensions. It is possible to have inconsistent but valid configurations of tnrhtp and tnrhdb when LDAP is used to supply missing templates. SunOS 5.11 20 Jul 2007 tnchkdb(1M)
Check Out this Related Man Page
setflabel(3TSOL) Trusted Extensions Library Functions setflabel(3TSOL) NAME
setflabel - move file to zone with corresponding sensitivity label SYNOPSIS
cc [flag...] file... -ltsol [library...] #include <tsol/label.h> int setflabel(const char *path, const m_label_t *label_p); DESCRIPTION
The file that is named by path is relabeled by moving it to a new pathname relative to the root directory of the zone corresponding to label_p. If the source and destination file systems are loopback mounted from the same underlying file system, the file is renamed. Other- wise, the file is copied and removed from the source directory. The setflabel() function enforces the following policy checks: o If the sensitivity label of label_p equals the existing sensitivity label, then the file is not moved. o If the corresponding directory does not exist in the destination zone, or if the directory exists, but has a different label than label_p, the file is not moved. Also, if the file already exists in the destination directory, the file is not moved. o If the sensitivity label of the existing file is not equal to the calling process label and the caller is not in the global zone, then the file is not moved. If the caller is in the global zone, the existing file label must be in a labeled zone (not ADMIN_LOW or ADMIN_HIGH). o If the calling process does not have write access to both the source and destination directories, then the calling process must have PRIV_FILE_DAC_WRITE in its set of effective privileges. o If the sensitivity label of label_p provides read only access to the existing sensitivity label (an upgrade), then the user must have the solaris.label.file.upgrade authorization. In addition, if the current zone is a labeled zone, then it must have been assigned the privilege PRIV_FILE_UPGRADE_SL when the zone was configured. o If the sensitivity label of label_p does not provide access to the existing sensitivity label (a downgrade), then the calling user must have the solaris.label.file.downgrade authorization. In addition, if the current zone is a labeled zone, then it must have been assigned the privilege PRIV_FILE_DOWNGRADE_SL when the zone was configured. o If the calling process is not in the global zone, and the user does not have the solaris.label.range authorization, then label_p must be within the user's label range and within the system accreditation range. o If the existing file is in use (not tranquil) it is not moved. This tranquility check does not cover race conditions nor remote file access. Additional policy constraints can be implemented by customizing the shell script /etc/security/tsol/relabel. See the comments in this file. RETURN VALUES
Upon successful completion, setflabel() returns 0. Otherwise it returns -1 and sets errno to indicate the error. ERRORS
The setflabel() function fails and the file is unchanged if: EACCES Search permission is denied for a component of the path prefix of path. The calling process does not have mandatory write access to the final component of path because the sensitivity label of the final component of path does not dominate the sensitivity label of the calling process and the calling process does not have PRIV_FILE_MAC_WRITE in its set of effective privileges. EBUSY There is an open file descriptor reference to the final component of path. ECONNREFUSED A connection to the label daemon could not be established. EEXIST A file with the same name exists in the destination directory. EINVAL Improper parameters were received by the label daemon. EISDIR The existing file is a directory. ELOOP Too many symbolic links were encountered in translating path. EMLINK The existing file is hardlinked to another file. ENAMETOOLONG The length of the path argument exceeds PATH_MAX. ENOENT The file referred to by path does not exist. EROFS The file system is read-only or its label is ADMIN_LOW or ADMIN_HIGH. ATTRIBUTES
See attributes(5) for descriptions of the following attributes: +-----------------------+-----------------------------------+ | ATTRIBUTE TYPE | ATTRIBUTE VALUE | +-----------------------+-----------------------------------+ |Interface Stability | Committed | +-----------------------+-----------------------------------+ |MT-Level | MT-Safe | +-----------------------+-----------------------------------+ SEE ALSO
libtsol(3LIB), attributes(5) Setting a File Sensitivity Label in Solaris Trusted Extensions Developer's Guide NOTES
The functionality described on this manual page is available only if the system is configured with Trusted Extensions. SunOS 5.11 20 Jul 2007 setflabel(3TSOL)