On 08/18/10 04:49 AM, YC Wang wrote:
Jarrett and Glenn already answered the privilege question.
For the case where you are initiating a connection from
a Trusted Extensions system to an unlabeled node, the
application you run must also be using the SO_MAC_EXEMPT
socket option either explicitly in the code or implicitly
through the ppriv -M switch. See
"MAC-Exempt Sockets" in
Solaris Trusted Extensions Developer's Guide
http://docs.sun.com/app/docs/doc/819-0869/api-intro-11?l=en&a=view
Thanks. Your information really helped.
In this case, there is no MAC-Exempt equivalent on the
client side. You can however set up a server-side application
with a multilevel port that is capable of responding to clients
that function at different security labels. See
"Zones and Multilevel Ports" in
Solaris Trusted Extensions Administrator's Procedures
http://docs.sun.com/app/docs/doc/819-0872/managezones-31?l=en&a=view
and
"Multilevel Ports" in
Solaris Trusted Extensions Developer's Guide
http://docs.sun.com/app/docs/doc/819-0869/api-intro-9?l=en&a=view
Ken
I noticed that when binding a Multilevel *udp* Port, a EINVAL error is
always returned. Do you have any idea about this?
I suspect that your UDP application did not have the SCM_UCRED
socket option set before attempting to bind to an MLP port.
Multi-level server applications are expected to respond with
the security label that was attached to the original message
from the client. UDP applications do this by getting the remote
process credentials on a recvmsg() and providing those same
credentials on a sendmsg() call. See
"Using Multilevel Ports With UDP" in
Solaris Trusted Extensions Developer's Guide
http://docs.sun.com/app/docs/doc/819-0869/mlpsandudp?l=en&a=view
Ken
_______________________________________________
security-discuss mailing list
[email protected]
