device_allocate(4) File Formats device_allocate(4)
device_allocate - device_allocate file
The device_allocate file is an ASCII file that resides in the /etc/security directory. It
contains mandatory access control information about each physical device. Each device is
represented by a one- line entry of the form:
Represents an arbitrary ASCII string naming the physical device. This field contains
no embedded white space or non-printable characters.
Represents an arbitrary ASCII string naming the generic device type. This field iden-
tifies and groups together devices of like type. This field contains no embedded white
space or non-printable characters. The following types of devices are currently man-
aged by the system: audio, sr (represents CDROM drives), fd (represents floppy
drives), st (represents tape drives), rmdisk (removable media devices).
On systems configured with Trusted Extensions, this field stores a colon-separated (:)
list of key-value pairs that describe device allocation attributes used in Trusted
Extensions. Zero or more keys can be specified. The following keys are currently
interpreted by Trusted Extensions systems:
Specifies the minimum label at which device can be allocated. Default value is
Specifies the maximum label at which device can be allocated. Default value is
Specifies the name of the zone in which device is currently allocated.
Specifies a logical grouping of devices. For example, all Sun Ray devices of all
device types. There is no default class.
Specifies the X display name. This is used to identify devices associated with
that X session. There is no default xdpy value.
Represents a field reserved for future use.
Represents a field that contains a comma-separated list of authorizations required to
allocate the device, an asterisk (*) to indicate that the device is not allocatable,
or an '@' symbol to indicate that no explicit authorization is needed to allocate the
device. The default authorization is solaris.device.allocate. See auths(1).
The physical device's data clean program to be run any time the device is acted on by
allocate(1). This ensures that unmanaged data does not remain in the physical device
between uses. This field contains the filename of a program in /etc/security/lib or
the full pathname of a cleanup script provided by the system administrator.
Notes on device_allocate
The device_allocate file is an ASCII file that resides in the /etc/security directory.
Lines in device_allocate can end with a `\' to continue an entry on the next line.
Comments can also be included. A `#' makes a comment of all further text until the next
NEWLINE not immediately preceded by a `\'.
White space is allowed in any field.
The device_allocate file must be created by the system administrator before device alloca-
tion is enabled.
The device_allocate file is owned by root, with a group of sys, and a mode of 0644.
Example 1 Declaring an Allocatable Device
Declare that physical device st0 is a type st. st is allocatable, and the script used to
clean the device after running deallocate(1) is named /etc/security/lib/st_clean.
# scsi tape
Example 2 Declaring an Allocatable Device with Authorizations
Declare that physical device fd0 is of type fd. fd is allocatable by users with the
solaris.device.allocate authorization, and the script used to clean the device after run-
ning deallocate(1) is named /etc/security/lib/fd_clean.
# floppy drive
Making a device allocatable means that you need to allocate and deallocate it to use it
(with allocate(1) and deallocate(1)). If a device is not allocatable, there is an asterisk
(*) in the auths field, and no one can use the device.
Contains list of allocatable devices
See attributes(5) for descriptions of the following attributes:
| ATTRIBUTE TYPE | ATTRIBUTE VALUE |
|Interface Stability |Uncommitted |
auths(1), allocate(1), bsmconv(1M), deallocate(1), list_devices(1), auth_attr(4),
The functionality described in this man page is available only if Solaris Auditing has
been enabled. See bsmconv(1M) for more information.
On systems configured with Trusted Extensions, the functionality is enabled by default. On
such systems, the device_allocate file is updated automatically by the system.
SunOS 5.11 12 May 2008 device_allocate(4)