From sommerfeld@sun.com Thu May 3 11:01:15 2007 Received: from sunmail3mpk.sfbay.sun.com (sunmail3mpk.SFBay.Sun.COM [129.146.11.52]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l43I1FHX023270 for ; Thu, 3 May 2007 11:01:15 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail3mpk.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id l43I0A0E010888; Thu, 3 May 2007 11:00:17 -0700 (PDT) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JHH00J1J8ODOW00@nwk-avmta-2.sfbay.sun.com>; Thu, 03 May 2007 11:00:13 -0700 (PDT) Received: from eastmail4bur.east.Sun.COM ([129.148.13.1]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JHH00I3G8OACC20@nwk-avmta-2.sfbay.sun.com>; Thu, 03 May 2007 11:00:10 -0700 (PDT) Received: from thunk.east.sun.com (thunk.East.Sun.COM [129.148.174.66]) by eastmail4bur.east.Sun.COM (8.13.6+Sun/8.13.6/ENSMAIL,v2.2) with ESMTP id l43I07IV021392; Thu, 03 May 2007 14:00:08 -0400 (EDT) Received: from [IPv6:::1] (localhost [IPv6:::1]) by thunk.east.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l43I07bG022149; Thu, 03 May 2007 14:00:07 -0400 (EDT) Date: Thu, 03 May 2007 14:00:06 -0400 From: Bill Sommerfeld Subject: 2007/255 DOI Handling Amendment To: PSARC-EXT Cc: Ken Powell Message-id: <1178215206.21685.10.camel@thunk> MIME-version: 1.0 X-Mailer: Evolution 2.8.1.1 Content-type: text/plain Content-transfer-encoding: 7BIT X-PMX-Version: 5.2.0.264296 Status: RO Content-Length: 4336 I'm sponsoring the following fasttrack for Ken Powell. Release binding is Patch; this represents a small change to the behavior of a Contracted Consolidation Private interface below the threshold which would require a revised contract. At present, both consumer and supplier are maintained by the same engineers. Timer expires 5/10/2007 While both this case and 2007/254 touch on with TX initialization, they don't actually conflict with each other; the single-DOI limitation (that this case doesn't change) is one of the reasons that a reboot is currently required to enable labelled operation. At present, a bug prevents the use of a CIPSO Domain of Interpretation value other than 1; this case proposes a minor interface change to zone_create() and tsol_sgetzcent() to permit a system administrator to pick the system DOI. ----- The Trusted Extensions (TX) project, PSARC 2005/060 added a Domain of Interpretation (DOI) and a zone label parameter to the zone_create() function. It also defined the tsol_sgetzcent() library service to get zone label information from the tnzonecfg(4) file. A "DOI" is an identifier which selects a particular interpretation of the bits within a binary sensitivity label. Sensitivity labels with different DOI values are not ordered with respect to each other. TX defines a "system" DOI; at present, TX only works if labelled zones use a label defined within that system DOI because zone labels must be ordered with respect to the ADMIN_LOW labels associated with global zone data. However, the zone_create interface was defined in a way which permits the creation of labelled zones in arbitrary DOIs. The ARC materials were vague about this point: http://sac.sfbay/PSARC/2005/060/final.materials/Design_doc.txt: 3.2 Labels and Zones -------------------- As described in PSARC/2002/762 case, TX uses the Solaris Zones feature as the basic building block for implementing a labeled system. Specifically, a zone is associated with a label and is referred to as a labeled zone in TX. Typically everything within a labeled zone (processes, objects, etc.) inherits the label of the zone, with some exceptions (see MLP section for more details). The global zone is associated with the ADMIN_LOW label, which is dominated by all other labels in the system**. Rampart has extended the zone_create() interface to construct a zone with label information. A zone's label is set when the zone is brought up and it cannot be changed without rebooting the zone. The zone's label is derived from the tnzonecfg(4) file and is loaded into kernel by the zoneadmd(1M) while booting the zone. **Note that it is a necessity that all DOI's are consistent to meet this requirement (as well as other requirements of our implementation and the CIPSO draft.) We propose to change zone_create() to verify the DOI value provided is either the system DOI, or the reserved value 0 to indicate "use system DOI". This check enforces the current single-DOI limitation. At present, tnzonecfg(4) entries do not specify a DOI value. Instead, tsol_sgetzcent() returns a hard-coded DOI value of 1. This makes it impossible to use Solaris with Trusted Extensions in any environment where the DOI is not 1. As an interim step, we propose to change tsol_sgetzcent() to return a DOI value of 0 indicating "DOI not explicitly specified, use system DOI". We considered removing the DOI from the zone_create() and tsol_sgetzcent() interfaces, but rejected this alternative as it may make it more difficult to later extend the system to better handle environments in which multiple DOIs are in use simultaneously. Related Work: tsol_sgetzcent() is defined to be Contracted Consolidation Private. tsol_sgetzcent() is currently used by the TLC, CDE, and JDS consolidations. The CDE and JDS consolidations are not impacted by this change. The TLC consolidation is maintained by the Trusted Extensions team. The tnchkdb(1M) utility in TLC consolidation incorrectly checked that all DOI's were set to 1. This problem was recently fixed under CR 6520317, with the result that this proposed change will have no further impact on any code in the TLC consolidation. This proposal has no other impact to code outside ON. From sommerfeld@sun.com Wed May 9 10:22:58 2007 Received: from newsunmail1brm.central.sun.com (newsunmail1brm.Central.Sun.COM [129.147.62.245]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l49HMvVa022061 for ; Wed, 9 May 2007 10:22:58 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by newsunmail1brm.central.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id l49HLqXH061005; Wed, 9 May 2007 11:21:54 -0600 (MDT) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JHS00107AWHED00@nwk-avmta-1.sfbay.Sun.COM>; Wed, 09 May 2007 10:21:53 -0700 (PDT) Received: from eastmail4bur.east.Sun.COM ([129.148.13.1]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JHS00HUCAWGFR80@nwk-avmta-1.sfbay.Sun.COM>; Wed, 09 May 2007 10:21:53 -0700 (PDT) Received: from thunk.east.sun.com (thunk.East.Sun.COM [129.148.174.66]) by eastmail4bur.east.Sun.COM (8.13.6+Sun/8.13.6/ENSMAIL,v2.2) with ESMTP id l49HLq6f007564; Wed, 09 May 2007 13:21:52 -0400 (EDT) Received: from [IPv6:::1] (localhost [IPv6:::1]) by thunk.east.sun.com (8.13.8+Sun/8.13.8) with ESMTP id l49HLqi3019855; Wed, 09 May 2007 13:21:52 -0400 (EDT) Date: Wed, 09 May 2007 13:21:50 -0400 From: Bill Sommerfeld Subject: Re: 2007/255 DOI Handling Amendment In-reply-to: <1178215206.21685.10.camel@thunk> To: PSARC-EXT Cc: Ken Powell Message-id: <1178731310.19792.5.camel@thunk> MIME-version: 1.0 X-Mailer: Evolution 2.8.1.1 Content-type: text/plain Content-transfer-encoding: 7BIT X-PMX-Version: 5.2.0.264296 References: <1178215206.21685.10.camel@thunk> Status: RO Content-Length: 226 This case was approved during today's PSARC meeting. Gary W. asked me to note for the record that while CIPSO didn't progress at the IETF (the internet draft expired and has no formal status), it was published as FIPS 188.