Wiki code for Running Trusted Extensions in OpenSolaris 2009.06

Hide Line numbers
1: == Running Trusted Extensions in OpenSolaris 2009.06
2: 
3: Trusted Extensions is a feature of OpenSolaris 2009.06 It can be installed and configured after you have completed the default installation of OpenSolaris 2009.06 from the LiveCD, either running directly on the hardware or as a VirtualBox guest. These instructions assume that you have created a user account during the initial installation, and that **root** is a role that you can assume.
4: 
5: ===Install the Trusted Extensions Packages
6: 
7: After installing OpenSolaris 2009.06, open the Package Manager, select **Trusted Extensions**, then **Edit**->**Select All**.Then select **Install/Update**.
8: 
9: ===Workarounds
10: 
11: ==== Problems with the Sysidtools and Zone Cloning
12: 
13: Some corrections may be necessary to enable proper system identification for labeled zones. These steps are required if you have specified a hostname other than the default **opensolaris**.
14: 
15: Use the root role to make the following edits. Be sure to make copies of the files before making any modifications.
16: 
17: =====/usr/sbin/txzonemgr
18: 
19: Comment out line 191 as follows:
20: 
21: {{{
22:     #initialize
23: }}}
24: 
25: Comment out line 287 as follows:
26: 
27: {{{
28:     #rm -d ${ZONE~_ETC~_DIR}/.UNCONFIGURED
29: }}}
30: 
31: Add the following line after line 45, containing **zonename=""**
32: 
33: {{{
34:     command=""
35: }}}
36: 
37: =====Labeled brand changes
38: 
39: {{{
40:     cd /usr/lib/brand/labeled
41:     cp ../ipkg/clone .
42:     cp ../ipkg/pkgcreatezone .
43: }}}
44: 
45: =====/usr/lib/brand/labeled/config.xml
46: 
47: In line 40, change the directory in the pathname from **ipkg** to **labeled**
48: 
49: {{{
50:     <install>/usr/lib/brand/**labeled**/pkgcreatezone -z %z -R %R</install>
51: }}}
52: 
53: In line 50, change the directory in the pathname from **ipkg** to **labeled**
54: 
55: {{{
56:     <clone>/usr/lib/brand/**labeled**/clone -z %z -R %R>/clone>
57: }}}
58: 
59: =====/usr/lib/brand/labeled/clone
60: 
61: Comment out line 137 as follows:
62: 
63: {{{
64:     #/usr/sbin/sys-unconfig -R $zonepath/root || fail~_incomplete "$f_sysunconfig"
65: }}}
66: 
67: =====/usr/lib/brand/labeled/pkgcreatezone
68: 
69: Comment out lines 434 and 443 as follows:
70: 
71: {{{
72:     # if [$sys_labeled -eq 0 ]; then
73:     ...
74:     #fi
75: }}}
76: 
77: ====Set up the Automounter (required for TX)
78: 
79: Edit **/etc/passwd**, changing your home directory from
80:    **/export/home///you//**
81: to
82:    **/home///you//**
83: 
84: Edit **/etc/auto_home** adding the following:
85: 
86:      \* -fstype=lofs  :/export/home/&
87: ==
88: 
89: ====Make Room for the Trusted Stripe at the Top
90: 
91: In top GNOME panel, right click and select **Properties**.
92: Change the **Orientation** of the top panel to **Bottom**
93: 
94: or if you want to make this the default for all users, you can do this:
95: 
96: {{{
97:     # export SETUPPANEL="/etc/gconf/schemas/panel-default-setup.entries"
98:     # export TMPPANEL="/tmp/panel-default-setup.entries"
99:     # sed ’s/<string>top<\/string>/<string>bottom<\/string>/’ $SETUPPANEL > $TMPPANEL
100:     # cp $TMPPANEL $SETUPPANEL
101:     # svcadm restart gconf-cache
102: }}}
103: 
104: All new users will then have both of their panels set to the bottom of the display.
105: 
106: ===Enable Trusted Extensions
107: 
108: {{{
109:     # svcadm enable -s labeld
110:     # reboot
111: }}}
112: 
113: ===Initial Login to Trusted Extensions
114: 
115: After the system reboots and the gdm login window appear, select
116: 
117: {{{
118:     Options->Select Session...->Solaris Trusted Extensions (GNOME)->Change Session->Make Default
119: }}}
120: 
121: Login as yourself
122: 
123: Click OK twice (once for the status window and once for the clearance window)
124: 
125: GNOME will complain four times (once per workspace) that //The label PUBLIC has no matching zone//.
126: 
127: Dismiss each of the four dialogs.
128: 
129: ===Assume the Root Role
130: 
131: Switch to 4th workspace and assume root role using the pull down in the trusted stripe where your name is displayed. If the trusted stripe is not displayed, logout and login again. This is a bug that will be fixed soon.
132: 
133: ===Create the Public Zone
134: 
135: Bring up a Terminal and run
136: 
137: {{{
138:     # txzonemgr
139: }}}
140: 
141: There may be a usage error and/or other messages which you can ignore.
142: 
143: In the Labeled Zone Manager, make the following selections:
144: 
145: {{{
146:     Create a new zone...
147:     Enter Zone Name:  **public**
148:     Select Label... **PUBLIC**
149:     Install...
150:     Enter Hostname: **use the default, click OK**
151:     Zone Console...
152:     Boot
153: }}}
154: 
155: When prompted in the zone console for a hostname, use the same hostname as the global zone. Don’t bother assigning a root password. Just press F2 twice.
156: 
157: The zone will reboot and you will be prompted to login. Instead, switch back to the Labeled Zone Manager and make the following selections:
158: 
159: {{{
160:     Halt
161:     Return to Main Menu
162:     Create a new zone
163:     Enter Zone Name:  **internal**
164:     Select Label... **CONFIDENTIAL : INTERNAL USE ONLY**
165:     Clone  **select public**
166:     Boot
167: }}}
168: 
169: ===Activate the Public Workspace
170: 
171: {{{
172:     Return to Main Menu
173:     public
174:     Boot
175: }}}
176: 
177: Switch back to the first workspace and bring up a Terminal. The desktop background should appear. Then bring up the Terminal again. It should be labeled **PUBLIC**.
178: 
179: ===Activate the Internal Workspace
180: 
181: Switch to the second workspace. Right-click and select **Change Workspace Label...**
182: 
183: Select **INTERNAL USE ONLY", click **OK**.
184: 
185: Bring up a Terminal. Then bring up the Terminal again. This one should be labeled **CONFIDENTIAL : INTERNAL USE ONLY**.
186: 
187: ===Configure Trusted Networking
188: 
189: See Glenn Faden’s blog for additional steps to configure [[Trusted Networking>>http://blogs.sun.com/gfaden/entry/some_issues_with_network_auto]] and [[Suspend and Resume>>http://blogs.sun.com/gfaden/entry/suepend_and_resume_in_opensolaris]].
OpenSolaris

Top Menu

Wiki code for Running Trusted Extensions in OpenSolaris 2009.06

Search

Collectives

Community Group

Project

User Group

Subsites

Community Group security Pages
