Additional Trusted Extensions Configuration Tasks

The following two tasks enable you to transfer exact copies of configuration files to every Trusted Extensions system at your site. The final task enables you to remove Trusted Extensions customizations from an Oracle Solaris system.

How to Copy Files to Portable Media in Trusted Extensions

When copying to portable media, label the media with the sensitivity label of the information.

Before You Begin

To copy administrative files, you must be in the root role in the global zone.

1. Allocate the appropriate device.

   Use the Device Manager, and insert clean media. For details, see How to Allocate a Device in Trusted Extensions in Trusted Extensions User’s Guide.

   The File Browser displays the contents of the clean media.

2. Open a second File Browser.
3. Navigate to the folder that contains the files to be copied
4. For each file, do the following:
   1. Highlight the icon for the file.
   2. Drag the file to the File Browser for the portable media.
5. Deallocate the device.

   For details, see How to Deallocate a Device in Trusted Extensions in Trusted Extensions User’s Guide.

6. On the File Browser for the portable media, choose Eject from the File menu.

   ---

   Note - Remember to physically affix a label to the media with the sensitivity label of the copied files.

   ---

Example 4-6 Keeping Configuration Files Identical on All Systems

The system administrator wants to ensure that every system is configured with the same settings. So, on the first system that is configured, the administrator creates a directory that cannot be deleted between reboots. In that directory, the administrator places the files that must be identical or very similar on all systems.

For example, the administrator modifies the policy.conf file, and the default login and passwd files for this site. So, the administrator copies the following files to the permanent directory.

# mkdir /export/commonfiles
# cp /etc/security/policy.conf \
# cp /etc/default/login \
# cp /etc/default/passwd \
# cp /etc/security/tsol/label_encodings \ /export/commonfiles

The administrator uses the Device Manager to allocate a CD-ROM in the global zone, transfers the files to the CD, and affixes a Trusted Path label.

How to Copy Files From Portable Media in Trusted Extensions

It is safe practice to rename the original Trusted Extensions file before replacing the file. When configuring a system, the root role renames and copies administrative files.

Before You Begin

To copy administrative files, you must be in the root role in the global zone.

1. Allocate the appropriate device.

   For details, see How to Allocate a Device in Trusted Extensions in Trusted Extensions User’s Guide.

   The File Browser displays the contents.

2. Insert the media that contains the administrative files.
3. If the system has a file of the same name, copy the original file to a new name.

   For example, add .orig to the end of the original file:

   # cp /etc/security/tsol/label_encodings /etc/security/tsol/label_encodings.orig

4. Open a File Browser.
5. Navigate to the desired destination directory, such as /etc/security/tsol
6. For each file that you want to copy, do the following:
   1. In the File Browser for the mounted media, highlight the icon for the file.
   2. Then, drag the file to the destination directory in the second File Browser.
7. Deallocate the device.

   For details, see How to Deallocate a Device in Trusted Extensions in Trusted Extensions User’s Guide.

8. When prompted, eject and remove the media.

How to Remove Trusted Extensions From the System

You must perform specific steps to remove the Trusted Extensions feature from an Oracle Solaris system.

Before You Begin

You are in the root role in the global zone.

1. Archive any data in the labeled zones that you want to keep.

   For portable media, affix a physical sticker with the sensitivity label of the zone to each archived zone.

2. Remove the labeled zones from the system.

   For details, see How to Remove a Non-Global Zone in Oracle Solaris Administration: Oracle Solaris Zones, Oracle Solaris 10 Zones, and Resource Management.

3. Disable the Trusted Extensions service.

   # svcadm disable labeld

4. Disable device allocation.

   # svcadm disable allocate

5. (Optional) Reboot the system.
6. Configure the system.

   Various services might need to be configured for your Oracle Solaris system. Possibilities include basic networking, naming services, and file system mounts.