IRIX Admin: Peripheral Devices Further, complete information on system backups can be found in the guide titled IRIX Admin: Backup, Security, and Accounting .
Printing under Trusted IRIX/CMW requires no special resources. Except where noted in this chapter, printing operates exactly as described in your standard IRIX documentation. Trusted IRIX/CMW meets the requirement for B1-level systems for labeled printing. Each page of printed output carries the label of the file printed at the top and bottom of the page.
The system intercepts the output of a print request before it is sent to the printer and ensures that appropriate banner pages and individual page labels are produced. Line printing under Trusted IRIX/CMW is essentially the same as under standard IRIX, except that printed copy is labeled and fewer printer options are supported. The printer daemon process, lpsched(8), must be run from the system startup scripts. It can be stopped and restarted while the system is running with the commands:
/etc/init.d/lp stop /etc/init.d/lp start |
Trusted IRIX/CMW supports line printing on ASCII (dumb) printers and PostScript® printers. The utilities that allow labeled PostScript output, however, are not resistant to label spoofing programs. Because of this weakness, it is up to the individual Site Security Officer to determine whether PostScript printing can be allowed at the site.
This section defines the methods implemented to properly label printed output. There are several parts to the printing system. There is the print job submission program, the program that produces the output (in the case of PostScript), and the program that labels the output.
PostScript requires a print job to be written in the PostScript definition language. This language specifies the parameters and specifics of the printout. Trusted IRIX/CMW has implemented a filter to this output production program that attaches labels to the individual page specifications and creates an appropriately labeled banner page.
ASCII printers rely on escape sequences within the print stream to provide directions to the printer. Trusted IRIX/CMW has implemented a filter for ASCII print jobs that inserts the labels into the print stream.
Trusted IRIX/CMW has implemented the following programs and utilities to produce labeled printer output. Using the information supplied here, the System Administrator can extend support to other printers. Printing interface utilities under UNIX are usually in the form of shell scripts that are invoked by the lp(1) command. The usual MAC policies are implemented around printing requests. The print request inherits the label of the file being printed, and this label is used to control access to the print job. For example, MAC must be satisfied in order to cancel the print job or to call up the job on the printer spooler queue. When printing on an ASCII printer, the print job is sent through the pr(1) filter program with the -b option in order to filter out escape sequences and apply the internal page labels.
Other optional arguments to the pr program are -l and -f, followed by the filename and the name of the type of printer.
The following series of commands configures the device /dev/plp as a dumb printer named elephant.
Log in as root at dblow and enter the following commands in order:
/etc/init.d/lp stop
This command stops the printing spooler while the operation takes place.
newlabel -F dbadmin
This command changes your label to dbadmin to perform the operation.
/usr/lib/lpadmin -pelephant -mdumb -v/dev/plp
This command directs lpadmin to create the dumb printer "elephant" on /dev/plp.
newlabel -F dblow /etc/init.d/lp start
This command changes your label back to dblow to restart the printing spooler.
/usr/bin/enable elephant
This command enables the new printer.
/usr/lib/accept elephant
This command directs the new printer to begin accepting requests.
/usr/lib/lpadmin -delephant
This command directs lpadmin to make the new printer the default printer.
/usr/lib/lpadmin -s msenhigh/mintlow...msenlow/minthigh -pelephant
This command sets the MAC label range that the printer will accept for jobs.
/usr/bin/lpstat -a
This command confirms that the printer is enabled and accepting requests
This process initializes /dev/plp and /dev/plpbi to the label dbadmin. Some larger systems such as CHALLENGE and Onyx systems have multiple /dev/plp ports and if you are installing printers on these ports, be sure that each one has been labeled at dbadmin..
If you are installing a serial printer, you can use any /dev/ttyd* port, and that port must be labeled at dbadmin.
One of the most important responsibilities of the System Administrator is that of preventive maintenance. It is very important to create frequent backups of all files on the system. It is far less painful to recover a system whose files are a day old than it is to start from scratch. If you back up your entire filesystem at least weekly and back up changed files every day, you can maintain a reasonable assurance that the data contained on your backups is uncorrupted and current.
The original distribution media for your system should always be stored in a safe place.
Once your trusted software is installed and configured, but before you allow users to begin work, make a complete backup of your system using tar and make a record of all your system files, their attributes and a checksum, and store this backup with your distribution media. With this record and the original tapes you should be able to recreate your system if needed.
Backups should be done by the individual users in a workstation environment or by the System Administrator if a server is used. The specific backup practices at any given site should be approved by the Site Security Officer. The tape device for Trusted IRIX/CMW (/dev/tape) is shipped with an exact label. The System Administrator must change this label each time a user at a different label wishes to use the tape device.
B1 systems are required to provide for labeled tape backups. Trusted IRIX/CMW meets this requirement by providing the new M keyword to the tar(1) command. This keyword directs tar to maintain the security labels on all files placed on the tape. To recover files from backup, use tar(1) with the M keyword. Always remember that it is still possible to make unlabeled backups using tar without the M keyword. Also, using tar to extract labeled files without the M keyword results in the loss of label data. It is therefore strongly recommended that access to the physical tape device and possession of magnetic tapes be limited to the System Administrator. Even though tar maintains labeling on the tape, the act of making a tape is still subject to MAC. Assuming that root makes the system backups, root should follow this procedure for system backups:
Log in to the user account for auditing ID.
Use the su command to change to the root identity.
Use the newlabel -m command to change your shell to multilevel.
Use the chlabel command to change the label of the tape device to match your label.
Change directories to the directory you wish to back up.
Give the command:
tar cvM . |
to begin the backup.
Write the highest label on your system on the surface of the tape cartridge, so it is not inadvertently made available or discarded.
Recovering files in this manner is the reverse of removal. You must again log in at msenhigh/mintequal, become root and make your shell multilevel. You must make certain that the tape device is properly labeled and then you can restore files using the tape you made previously. If all the files in a directory are known to be at a single label, you can log in with sufficient clearance and change the label of the tape device to match the directory label and make a single level backup. You should still use the M keyword to tar, however, to maintain the label information. Also, write the label of the information on the tape on the surface of the tape cartridge.
A program called /etc/rmt in Trusted IRIX/CMW allows you to use the remote tape drive feature of tar. The /etc/rmt file is distributed with the label binary.
To use the remote tape drive features of tar over a Monolabel network connection, you must change the label of /etc/rmt to match the label of your Monolabel network.