Oracle Solaris 11.3 安全扩展标签管理

需积分: 5 73 浏览量更新于2024-06-24 收藏 3.19MB PDF 举报

"Oracle Solaris 11.3 受信扩展标签管理-136" Oracle Solaris 11.3 的受信扩展是操作系统的一个关键特性，它提供了增强的安全性和访问控制，允许用户和系统管理员在一个单一的操作系统实例中划分不同的安全域。受信扩展的主要组成部分是标签管理系统，它允许基于安全级别的数据隔离，确保敏感信息不被未经授权的用户或进程访问。标签管理是受信扩展的核心，它创建了一个多层的安全模型，称为安全级别（Security Levels）。每个文件、进程、网络连接甚至窗口系统都可以被分配一个标签，这个标签代表了它的安全级别。这些标签可以是高安全性的，例如"Top Secret"，也可以是低安全性的，如"Public"。标签的设置和管理对于确保信息的保密性和完整性至关重要。在 Oracle Solaris 11.3 中，标签的管理包括创建、修改和管理这些安全级别，以及定义标签之间的转换规则。管理员可以使用 `zonecfg` 和 `zadmin` 工具来配置和管理受信扩展的标签策略，同时，`lslabel` 和 `chlabel` 命令用于查看和更改文件或目录的标签。此外，网络服务，如 NFS，也必须配置为支持标签，以确保跨网络的数据传输安全性。文档 "Trusted Extensions Label Administration Part No:E54843" 详细介绍了如何在 Oracle Solaris 11.3 中配置和使用这些功能。这涵盖了从基础概念到高级策略的所有内容，包括如何设置和管理安全策略，以及如何处理标签不匹配的情况。受信扩展还引入了彩色桌面（Color Desktop）的概念，这是一种可视化的方式来表示不同安全级别的桌面环境。用户界面的颜色变化反映了当前的安全级别，帮助用户直观地识别他们正在处理的信息的敏感性。值得注意的是，Oracle 对其软件和文档持有版权，并且在使用和分发时有特定的许可限制。禁止未经授权的反向工程、拆解或反编译软件，除非法律明确允许这样做是为了兼容性目的。对于美国政府或其代理机构用户，Oracle 软件可能会附带特定的通知，表明软件受特定的合同条款约束，特别是对于政府用途的软件可能需要遵守额外的限制。 Oracle Solaris 11.3 的受信扩展标签管理提供了一种强大而精细的安全机制，允许组织在单个操作系统上实现不同级别的信息保护，从而满足严格的安全政策和法规遵从性要求。

Types of Labels, Their Components and Uses

environments for learning purposes. A site might also customize one of the label_encodings

files that Trusted Extensions provides. For an example of a site-specific file, see Appendix A,

“Customized Encodings File for SecCompany”.

Every system in a Trusted Extensions network needs its own copy of the site's

label_encodings file. For interoperability, the label_encodings file on every system in the

network must be compatible. At the very least, each system must recognize the labels on every

other system.

Certain types of labels must be defined. The security administrator specifies the numeric

values and the bits that define the internal representation of labels. Users and roles view the

textual representation of labels. The labeling software translates between the internal form

and the textual form. The label_encodings file provides the rules for translating the internal

representation of labels to their textual form. The textual form can be visible on the desktop.

The internal representation is recorded in the audit trail and is interpreted by the praudit

command.

The security administrator is the person who defines and plans the implementation of an

organization's security policy. The security administrator establishes information protection

procedures, makes sure that users and administrators are properly trained, and monitors

compliance.

The Security Administrator role is created in the software. The role is assigned to one

or more administrators who fully understand Trusted Extensions administration. These

administrators are cleared to view and protect the highest level of information that is processed

by Trusted Extensions. One responsibility of the security administrator is to create the site's

label_encodings file to replace the version that is installed by default. The administrator can

also decide whether labels are visible on the desktop. Even when labels are not visible, objects

and processes on the system are labeled, and MAC is enforced.

Trusted Extensions provides the Security Administrator role with the tools and capabilities to

put the organization's security policy into effect. To assume the role, you first log in as a regular

user, then you assume the role. At your site, the security administrator who defines the site's

security policy might or might not be the same person who implements the policy.

Types of Labels, Their Components and Uses

Trusted Extensions defines two types of labels:

■

Sensitivity labels, often referred to as labels

■

Clearance labels, referred to as clearances

16 Trusted Extensions Label Administration • October 2017

Types of Labels, Their Components and Uses

Sensitivity labels, label ranges, and a label limit or clearance determine who can access which

objects on the system. Clearance labels are assigned to users. Sensitivity labels are assigned to

processes, including user processes, and to files and directories.

Some objects have a label range. These objects can be accessed at a particular label within the

defined label range. A label range from ADMIN_LOW to ADMIN_HIGH allows access at all labels.

The security administrator can narrow that label range. Objects with label ranges include the

following:

■

All hosts and networks with which communications are allowed

■

Zones

■

User accounts and role accounts

■

Allocatable devices, such as tape drives, CD-ROM and DVD devices, and audio devices

■

Other devices that are not allocatable, for example, printers, workstations (which are

controlled through the label range of the frame buffer), and serial lines when they are used

as a login device

The various procedures for setting labels on these objects is described in Trusted Extensions

Configuration and Administration. “Device Manager GUI” in Trusted Extensions Configuration

and Administration describes how to set label ranges on devices.

Label Ranges Restrict Access

Label ranges set limits on the following:

■

The labels at which hosts can send and receive information.

■

The labels at which processes acting on behalf of users and roles can access files and

directories in zones.

■

The labels at which users can allocate devices, thereby restricting the labels at which files

can be written to storage media in these devices.

■

The labels at which users can send jobs to printers.

■

The labels at which users can log in to workstations. In addition to the user's label range, a

label range on the frame buffer can be used to restrict access to a system.

Labels are automatically assigned to email messages. Emails are only visible in an email reader

at the label of the message. The label of an email is printed when the email is printed.

Chapter 1 • About Labels in Trusted Extensions 17

剩余135页未读，继续阅读

weixin_40191861_zj

粉丝: 83
资源: 1万+

Oracle Solaris 11.3 安全扩展标签管理

Oracle Solaris 11.3 Trusted Extensions Configuration and Admini

Oracle Solaris 11 Trusted Extensions Label Administration-124

Oracle Solaris 10 Trusted Extensions Label Administration-120

Oracle Solaris 11.2 Trusted Extensions Label Administration-122

Oracle Solaris 11.1 Trusted Extensions Label Administration-122

Oracle Solaris 11.3 Trusted Extensions User's Guide-82

Oracle Solaris 11.3 Trusted Extensions Developer's Guide-122

Oracle Solaris 10 Trusted Extensions Configuration Guide-176

Oracle Solaris10 Trusted Extensions配置指南-172

Oracle Solaris 11 Trusted Extensions User's Guide-76

最新资源