From gww@sac.sfbay.sun.com Tue Jun 2 12:57:03 2009 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n52Jv2G1028076 for ; Tue, 2 Jun 2009 12:57:02 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail5.uk.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id n52Juw69010683; Tue, 2 Jun 2009 20:57:01 +0100 (BST) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KKM00F01NF0QY00@nwk-avmta-2.sfbay.sun.com>; Tue, 02 Jun 2009 12:57:00 -0700 (PDT) Received: from dm-sfbay-02.sfbay.sun.com ([129.146.11.31]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KKM00996NEZNC60@nwk-avmta-2.sfbay.sun.com>; Tue, 02 Jun 2009 12:56:59 -0700 (PDT) Received: from sac.sfbay.sun.com (sac.SFBay.Sun.COM [129.146.226.132]) by dm-sfbay-02.sfbay.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id n52Juxiu001410; Tue, 02 Jun 2009 12:56:59 -0700 (PDT) Received: from sac.sfbay.sun.com (localhost [127.0.0.1]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n52JuwR4028071; Tue, 02 Jun 2009 12:56:58 -0700 (PDT) Received: (from gww@localhost) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8/Submit) id n52JuveC028067; Tue, 02 Jun 2009 12:56:57 -0700 (PDT) Date: Tue, 02 Jun 2009 12:56:57 -0700 (PDT) From: Gary Winiger Subject: PSARC/2009/333 str_to_label() update To: PSARC-ext@sun.com Cc: rampart-dev-team@sun.com Message-id: <200906021956.n52JuveC028067@sac.sfbay.sun.com> Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 Status: RO Content-Length: 2689 I'm sponsoring this case for myself. It updates the PSARC/2005/259 "Layered Trusted Solaris Label Interfaces" str_to_label(3tsol) function. The commitment level remains Committed. A Patch release binding is requested. A full diff marked man page is in the case directory. The timer is set for 10 June, 2009. Gary.. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Background: ========== str_to_label() is the Committed interface to translate strings to various type of labels in Solaris Trusted Extensions. The implementation is a client side in libtsol(3LIB), which for label translation services call the labeld(1M) service. labeld in turn implements a set of algorithms which parse strings based on rules define in label_encodings(4). For MAC_LABEL type labels, a set of supplemental rules called the ACCREDITATION RANGE: are defined. str_to_label() does not provide an interface that takes these rules into account. There is a Project Private interface to check against the accreditation range. A recent request for a Committed interface lead to RFE 6845609 "str_to_label(3) should be able to verify if the label is within the accreditation range" Proposal: ======== Provide for optional checking if the string being translated is acceptable to the accreditation range rules. A new error code, M_OUTSIDE_AR, will be returned if the resulting str_to_label() translation is not in the label_encodings(4) defined accreditation range and a new flag, L_CHECK_AR, is passed in. str_to_label(3TSOL): int str_to_label(const char *string, m_label_t **label, const m_label_type_t label_type, uint_t flags, int *error); DESCRIPTION The str_to_label() function is a simple function to parse human readable strings into labels of the requested type. [ . . . ] If flags is L_DEFAULT, the previously parsed label is replaced and the parsing algorithm makes a best effort to imply a valid label from the elements of string. + If flags contains L_CHECK_AR logically or-ed with another value, + the resulting label will be checked to ensure that it is within + the "Accreditation Range" of the DIA encodings schema. This flag + is only interpreted for MAC_LABEL label types. [ . . . ] ERRORS The str_to_label() function will fail if: EINVAL Invalid parameter. M_BAD_STRING indicates that string could not be parsed. M_BAD_LABEL indicates | that the label passed in was in error. M_OUTSIDE_AR + indicates that the resulting label is not within the + "Accreditation Range" specified in the DIA encodings + schema. From Glenn.Faden@sun.com Tue Jun 2 13:01:35 2009 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n52K1YpI028269 for ; Tue, 2 Jun 2009 13:01:34 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail5.uk.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id n52K0k4Y012800; Tue, 2 Jun 2009 21:01:33 +0100 (BST) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KKM00309NMKNE00@nwk-avmta-1.sfbay.Sun.COM>; Tue, 02 Jun 2009 13:01:32 -0700 (PDT) Received: from sca-es-mail-1.sun.com ([192.18.43.132]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KKM00MHLNMI36C0@nwk-avmta-1.sfbay.Sun.COM>; Tue, 02 Jun 2009 13:01:30 -0700 (PDT) Received: from fe-sfbay-10.sun.com ([192.18.43.129]) by sca-es-mail-1.sun.com (8.13.7+Sun/8.12.9) with ESMTP id n52K1Uqm019754; Tue, 02 Jun 2009 13:01:30 -0700 (PDT) Received: from conversion-daemon.fe-sfbay-10.sun.com by fe-sfbay-10.sun.com (Sun Java(tm) System Messaging Server 7u2-7.02 64bit (built Apr 16 2009)) id <0KKM00100NF75U00@fe-sfbay-10.sun.com>; Tue, 02 Jun 2009 13:01:30 -0700 (PDT) Received: from [192.168.0.140] ([unknown] [24.5.105.37]) by fe-sfbay-10.sun.com (Sun Java(tm) System Messaging Server 7u2-7.02 64bit (built Apr 16 2009)) with ESMTPSA id <0KKM00GB5NME25B0@fe-sfbay-10.sun.com>; Tue, 02 Jun 2009 13:01:26 -0700 (PDT) Date: Tue, 02 Jun 2009 13:01:26 -0700 From: Glenn Faden Subject: Re: PSARC/2009/333 str_to_label() update In-reply-to: <200906021956.n52JuveC028067@sac.sfbay.sun.com> Sender: Glenn.Faden@sun.com To: Gary Winiger Cc: PSARC-ext@sun.com, rampart-dev-team@sun.com Message-id: <4A258516.4000506@sun.com> MIME-version: 1.0 Content-type: text/plain; CHARSET=US-ASCII; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200906021956.n52JuveC028067@sac.sfbay.sun.com> User-Agent: Thunderbird 2.0.0.21 (Macintosh/20090302) Status: RO Content-Length: 2856 Looks good to me. --Glenn Gary Winiger wrote: > I'm sponsoring this case for myself. It updates the PSARC/2005/259 > "Layered Trusted Solaris Label Interfaces" str_to_label(3tsol) function. > > The commitment level remains Committed. A Patch release binding is requested. > A full diff marked man page is in the case directory. > > The timer is set for 10 June, 2009. > > Gary.. > ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ > Background: > ========== > str_to_label() is the Committed interface to translate strings to various > type of labels in Solaris Trusted Extensions. The implementation is a > client side in libtsol(3LIB), which for label translation services call > the labeld(1M) service. labeld in turn implements a set of algorithms > which parse strings based on rules define in label_encodings(4). > For MAC_LABEL type labels, a set of supplemental rules called the > ACCREDITATION RANGE: are defined. str_to_label() does not provide an > interface that takes these rules into account. There is a Project Private > interface to check against the accreditation range. A recent request > for a Committed interface lead to RFE 6845609 "str_to_label(3) should be > able to verify if the label is within the accreditation range" > > Proposal: > ======== > Provide for optional checking if the string being translated is acceptable > to the accreditation range rules. A new error code, M_OUTSIDE_AR, will be > returned if the resulting str_to_label() translation is not in the > label_encodings(4) defined accreditation range and a new flag, L_CHECK_AR, > is passed in. > > str_to_label(3TSOL): > > int str_to_label(const char *string, m_label_t **label, > const m_label_type_t label_type, uint_t flags, int *error); > > DESCRIPTION > The str_to_label() function is a simple function to parse > human readable strings into labels of the requested type. > > [ . . . ] > > If flags is L_DEFAULT, the previously parsed label is > replaced and the parsing algorithm makes a best effort to > imply a valid label from the elements of string. > > + If flags contains L_CHECK_AR logically or-ed with another value, > + the resulting label will be checked to ensure that it is within > + the "Accreditation Range" of the DIA encodings schema. This flag > + is only interpreted for MAC_LABEL label types. > > [ . . . ] > > ERRORS > The str_to_label() function will fail if: > > EINVAL Invalid parameter. M_BAD_STRING indicates that > string could not be parsed. M_BAD_LABEL indicates > | that the label passed in was in error. M_OUTSIDE_AR > + indicates that the resulting label is not within the > + "Accreditation Range" specified in the DIA encodings > + schema. > From carlsonj@phorcys.east.sun.com Tue Jun 2 13:27:33 2009 Received: from sunmail2sca.sfbay.sun.com (sunmail2sca.SFBay.Sun.COM [129.145.155.234]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n52KRXZ4028801 for ; Tue, 2 Jun 2009 13:27:33 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail2sca.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id n52KRXiU018469; Tue, 2 Jun 2009 13:27:33 -0700 (PDT) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KKM00805OTWEM00@nwk-avmta-1.sfbay.Sun.COM>; Tue, 02 Jun 2009 13:27:32 -0700 (PDT) Received: from dm-east-02.east.sun.com ([129.148.13.5]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KKM00MN2OTU31D0@nwk-avmta-1.sfbay.Sun.COM>; Tue, 02 Jun 2009 13:27:31 -0700 (PDT) Received: from phorcys.east.sun.com (phorcys.East.Sun.COM [129.148.174.143]) by dm-east-02.east.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id n52KRTfj014983; Tue, 02 Jun 2009 16:27:29 -0400 (EDT) Received: from phorcys.east.sun.com (phorcys.local [127.0.0.1]) by phorcys.east.sun.com (8.14.3+Sun/8.14.3) with ESMTP id n52KQLYO009632; Tue, 02 Jun 2009 16:26:22 -0400 (EDT) Received: (from carlsonj@localhost) by phorcys.east.sun.com (8.14.3+Sun/8.14.3/Submit) id n52KQL8X009629; Tue, 02 Jun 2009 16:26:21 -0400 (EDT) Date: Tue, 02 Jun 2009 16:26:21 -0400 From: James Carlson Subject: Re: PSARC/2009/333 str_to_label() update In-reply-to: <200906021956.n52JuveC028067@sac.sfbay.sun.com> To: Gary Winiger Cc: PSARC-ext@sun.com, rampart-dev-team@sun.com Message-id: <18981.35565.934030.70473@gargle.gargle.HOWL> MIME-version: 1.0 X-Mailer: VM 7.01 under Emacs 21.3.1 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200906021956.n52JuveC028067@sac.sfbay.sun.com> Status: RO Content-Length: 534 Gary Winiger writes: > I'm sponsoring this case for myself. It updates the PSARC/2005/259 > "Layered Trusted Solaris Label Interfaces" str_to_label(3tsol) function. > > The commitment level remains Committed. A Patch release binding is requested. > A full diff marked man page is in the case directory. +1 -- James Carlson, Solaris Networking Sun Microsystems / 35 Network Drive 71.232W Vox +1 781 442 2084 MS UBUR02-212 / Burlington MA 01803-2757 42.496N Fax +1 781 442 1677 From gww@sac.sfbay.sun.com Wed Jun 3 11:02:18 2009 Received: from sunmail3mpk.sfbay.sun.com (sunmail3mpk.SFBay.Sun.COM [129.146.11.52]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n53I2IaR016266 for ; Wed, 3 Jun 2009 11:02:18 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail3mpk.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id n53I1uvC015428; Wed, 3 Jun 2009 11:02:18 -0700 (PDT) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0KKO00E3NCRRKR00@brm-avmta-1.central.sun.com>; Wed, 03 Jun 2009 12:02:15 -0600 (MDT) Received: from dm-sfbay-01.sfbay.sun.com ([129.145.155.118]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0KKO003TPCRPO180@brm-avmta-1.central.sun.com>; Wed, 03 Jun 2009 12:02:13 -0600 (MDT) Received: from sac.sfbay.sun.com (sac.SFBay.Sun.COM [129.146.226.132]) by dm-sfbay-01.sfbay.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id n53I2DKt040311; Wed, 03 Jun 2009 11:02:13 -0700 (PDT) Received: from sac.sfbay.sun.com (localhost [127.0.0.1]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id n53I2Djx016261; Wed, 03 Jun 2009 11:02:13 -0700 (PDT) Received: (from gww@localhost) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8/Submit) id n53I2DJ3016260; Wed, 03 Jun 2009 11:02:13 -0700 (PDT) Date: Wed, 03 Jun 2009 11:02:13 -0700 (PDT) From: Gary Winiger Subject: Re: PSARC/2009/333 str_to_label() update To: PSARC-ext@sun.com Cc: rampart-dev-team@sun.com Message-id: <200906031802.n53I2DJ3016260@sac.sfbay.sun.com> Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 Status: RO Content-Length: 344 > I'm sponsoring this case for myself. It updates the PSARC/2005/259 > "Layered Trusted Solaris Label Interfaces" str_to_label(3tsol) function. > > The commitment level remains Committed. A Patch release binding is requested. > A full diff marked man page is in the case directory. This case was approved at today's PSARC meeting. Gary..