Chapter 10. Maintaining an Evaluated Configuration

If you intend to run the evaluated configuration of Trusted IRIX/CMW at your site, you should be aware that there are strict limits placed on the hardware and software that have been evaluated. This chapter defines the evaluated configuration. If anything is added to, modified in, or subtracted from the evaluated configuration as described in this chapter, you are no longer running the evaluated configuration. Your system may operate normally, but the configuration has not been tested for security.

Hardware Configuration

Trusted IRIX/CMW is under evaluation and the evaluated hardware list has not been finalized at the time of publication. However, Trusted IRIX/CMW runs on the entire Silicon Graphics family of workstations and servers.

The following peripheral devices are being evaluated with Trusted IRIX/CMW:

External SCSI tape drive  


This drive is available for purchase from Silicon Graphics.

Serial (dumb) printers 


As described in “Supported Printers” in Chapter 9, ``Administering Printing and Tape Devices,'' serial (dumb) ASCII printers are supported under the evaluated configuration of Trusted IRIX/CMW.

Network connections 


As described in Chapter 4, “Networking With Trusted IRIX/CMW,” the standard network connections supplied are supported.

Software Configuration

The Trusted IRIX/CMW software must be kept intact and used as directed to maintain the evaluated configuration. The sections below detail the evaluated software.

Use of the minthigh Integrity Label

Only software that is part of the evaluated TCB shipped with Trusted IRIX/CMW may use the minthigh integrity label. This level of integrity requires formal security evaluation. If you change the integrity grade of any other file to minthigh, you are no longer running the evaluated configuration.

Linked Files in the TCB

The symbolic link files shown in Table 10-1 provide additional names for the referenced programs.

Table 10-1. Linked Files in the TCB

Symbolic Link Name

Referenced Program Name

bin/4d

/bin/true

bin/4d60

/bin/true

bin/[

/bin/test

bin/chgrp

/bin/chown

bin/cp

/bin/ln

bin/m68000

/bin/false

bin/m68k

/bin/false

bin/mips

/bin/true

bin/multgrps

/bin/newgrp

bin/mv

/bin/ln

bin/pdp11

/bin/false

bin/printenv

/bin/env

bin/red

/bin/ed

bin/rsh

/bin/sh

bin/u3b

/bin/false

bin/u3b15

/bin/false

bin/u3b2

/bin/false

bin/u3b5

/bin/false

bin/vax

/bin/false

etc/autoconfig

/etc/init.d/autoconfig

etc/devnm

/bin/df

etc/rc0.d/K15cron

/etc/init.d/cron

etc/rc0.d/K20mail

/etc/init.d/mail

etc/rc0.d/K22acct

/etc/init.d/acct

etc/rc0.d/K25lp

/etc/init.d/lp

etc/rc0.d/K28audit

/etc/init.d/audit

etc/rc0.d/K39network

/etc/init.d/network.local

etc/rc0.d/K40network

/etc/init.d/network

etc/rc0.d/K90sysetup

/etc/init.d/sysetup

etc/rc2.d/S01MOUNTFSYS

/etc/init.d/MOUNTFSYS

etc/rc2.d/S20sysetup

/etc/init.d/sysetup

etc/rc2.d/S21perf

/etc/init.d/perf

etc/rc2.d/S22acct

/etc/init.d/acct

etc/rc2.d/S25audit

/etc/init.d/audit

etc/rc2.d/S30network

/etc/init.d/network

etc/rc2.d/S31network

/etc/init.d/network.local

etc/rc2.d/S48savecore

/etc/init.d/savecore

etc/rc2.d/S50mail

/etc/init.d/mail

etc/rc2.d/S58RMTMPFILES

/etc/init.d/RMTMPFILES

etc/rc2.d/S60lp

/etc/init.d/lp

etc/rc2.d/S75cron

/etc/init.d/cron

etc/rc2.d/S83audio

/etc/init.d/audio

etc/rc2.d/S88configmsg

/etc/init.d/configmsg

etc/rc2.d/S95autoconfig

/etc/init.d/autoconfig

etc/rc2.d/S98xdm

/etc/init.d/xdm

etc/telinit

/etc/init

usr/bin/apropos

/usr/bin/man

usr/bin/awk

/usr/bin/oawk

usr/bin/page

/usr/bsd/more

usr/bin/pcat

/usr/bin/unpack

usr/bin/whatis

/usr/bin/man

usr/bin/whoami

/usr/bin/id

usr/bsd/uncompress

/usr/bsd/compress

usr/bsd/uptime

/usr/bsd/w

usr/bsd/zcat

/usr/bsd/compress

usr/gfx/gfxinfo

/usr/gfx/gfxinit

usr/lib/cpp

/lib/cpp

usr/sbin/confirm

/usr/bin/X11/xconfirm

usr/sbin/inform

/usr/bin/X11/xconfirm

usr/sbin/pathconf

/usr/sbin/sysconf

usr/sbin/sgikopt

/etc/nvram

usr/sbin/versions

/usr/sbin/inst

usr/sysgen/root/usr/lib/cpp

/usr/sysgen/root/lib/cpp


List of TCB Files and Programs

The following sections list the files and programs that make up the Trusted IRIX/CMW Trusted Computing Base (TCB).

TCB Files in the root Directory

The /.cshrc and /.login files are found the root (/) directory.

TCB Files in the /bin Directory

The files shown in Table 10-2 are found in the /bin directory

Table 10-2. TCB Files in the /bin Directory

 

 

 

/bin/acctcom

/bin/basename

/bin/cat

/bin/chlabel

/bin/chmod

/bin/chown

/bin/cmp

/bin/date

/bin/dbedit

/bin/df

/bin/diff

/bin/dirname

/bin/echo

/bin/ed

/bin/env

/bin/expr

/bin/false

/bin/file

/bin/find

/bin/grep

/bin/hinv

/bin/ipcrm

/bin/ipcs

/bin/kill

/bin/line

/bin/ln

/bin/login

/bin/ls

/bin/mail

/bin/make

/bin/mkdir

/bin/mklbldb

/bin/mt

/bin/newgrp

/bin/newlabel

/bin/newpsoacl

/bin/nice

/bin/passwd

/bin/passwd_gen.off

/bin/pr

/bin/ps

/bin/psoacl

/bin/pwd

/bin/rm

/bin/rmdir

/bin/sat_echo

/bin/sat_interpret

bin/sat_reduce

/bin/sat_select

/bin/sat_summarize

/bin/satd

/bin/sed

/bin/sh

/bin/showlastlogin

/bin/showpwage

/bin/sleep

/bin/sort

/bin/stty

/bin/su

/bin/sum

/bin/sync

/bin/tail

/bin/tar

/bin/test

/bin/touch

/bin/true

/bin/tset

/bin/tty

/bin/uname

/bin/wc

/bin/who

 


TCB Files in the /dev Directory

The /dev/MAKEDEV file is found in the /dev directory.

TCB Files in the /etc Directory

The files shown in Table 10-3 are found in the /etc directory and its subdirectories:

Table 10-3. TCB Files in the /etc/directory

 

 

 

/etc/bcheckrc

/etc/brc

/etc/capability

/etc/chkconfig

/etc/chroot

/etc/clearance

/etc/config/netif.options

/etc/cron

/etc/cshrc

/etc/dfsck

/etc/dvhtool

/etc/fsck

/etc/fsstat

/etc/fstyp.d/fstyp.efs

/etc/fuser

/etc/getty

/etc/growfs

/etc/grpck

/etc/halt

/etc/havenfs

/etc/init

/etc/init.d/MOUNTFSYS

/etc/init.d/RMTMPFILES

/etc/init.d/acct

/etc/init.d/audio

/etc/init.d/audit

/etc/init.d/autoconfig

/etc/init.d/configmsg

/etc/init.d/cron

/etc/init.d/lp

/etc/init.d/mail

/etc/init.d/network

/etc/init.d/network.local

/etc/init.d/perf

/etc/init.d/savecore

/etc/init.d/sysetup

/etc/init.d/xdm

/etc/install

/etc/killall

/etc/labelit

/etc/lnsyscon

/etc/lvck

/etc/lvinfo

/etc/lvinit

/etc/mkfs

/etc/mklv

/etc/mknod

/etc/mount

/etc/mountall

/etc/multi

/etc/mvdir

/etc/ncheck

/etc/nvram

/etc/profile

/etc/pwck

/etc/rc0

/etc/rc2

/etc/rc3

/etc/reboot

/etc/renice

/etc/role

/etc/savecore

/etc/setmnt

/etc/shadow

/etc/showmount

/etc/shutdown

/etc/single

/etc/stdcshrc

/etc/stdlogin

/etc/stdprofile

/etc/swap

/etc/uadmin

/etc/umount

/etc/userck

/etc/wall


TCB Files in the /lib Directory

The /lib/cpp file is found in the /lib directory.

TCB Files in the /stand Directory

The fx, ide, and sash files are found in the /stand directory.

TCB Files in the /usr/adm Directory

The /usr/adm/.profile and /usr/adm/klogpp files are found in the /usr/adm directory.

TCB Files in the /usr/bin Directory

The files shown in Table 10-4 are found in the /usr/bin directory and its subdirectories:

Table 10-4. TCB Files in the /usr/bin Directory

 

 

 

/usr/bin/X11/4Dwm

/usr/bin/X11/X

/usr/bin/X11/Xsgi

/usr/bin/X11/appdefpath

/usr/bin/X11/endsession

/usr/bin/X11/mkfontdir

/usr/bin/X11/reaper

/usr/bin/X11/resize

/usr/bin/X11/tellwm

/usr/bin/X11/toolchest

/usr/bin/X11/userenv

/usr/bin/X11/wait4m

/usr/bin/X11/xclock

/usr/bin/X11/xconfirm

/usr/bin/X11/xdm

/usr/bin/X11/xdpyinfo

/usr/bin/X11/xhost

/usr/bin/X11/xlistscrns

/usr/bin/X11/xprop

/usr/bin/X11/xrdb

/usr/bin/X11/xrefresh

/usr/bin/X11/xset

/usr/bin/X11/xsetroot

/usr/bin/X11/xterm

/usr/bin/at

/usr/bin/banner

/usr/bin/batch

/usr/bin/cancel

/usr/bin/chrtbl

/usr/bin/col

/usr/bin/crontab

/usr/bin/cut

/usr/bin/disable

/usr/bin/enable

/usr/bin/fx

/usr/bin/getopt

/usr/bin/id

/usr/bin/lp

/usr/bin/lpstat

/usr/bin/man

/usr/bin/oawk

/usr/bin/rlp

/usr/bin/ul

/usr/bin/uniq

/usr/bin/unpack

/usr/bin/xargs

 

 


TCB Files in the /usr/bsd Directory

The files shown in Table 10-5 are found in the /usr/bsd directory:

Table 10-5. TCB Files in the /usr/bsd Directory

 

 

 

/usr/bsd/compress

/usr/bsd/ftp

/usr/bsd/head

/usr/bsd/hostid

/usr/bsd/hostname

/usr/bsd/logger

/usr/bsd/more

/usr/bsd/nslookup

/usr/bsd/rcp

/usr/bsd/rlogin

/usr/bsd/rsh

/usr/bsd/telnet

/usr/bsd/w

 

 


TCB Files in the /usr/etc Directory

The files shown in Table 10-6 are found in the /usr/etc directory and its subdirectories:

Table 10-6. TCB Files in the /usr/etc Directory

 

 

 

/usr/etc/arp

/usr/etc/audio/dsploader

/usr/etc/automount

/usr/etc/biod

/usr/etc/configmail

/usr/etc/dgld

/usr/etc/exportfs

/usr/etc/fsr

/usr/etc/ftpd

/usr/etc/ifconfig

/usr/etc/iflabel

/usr/etc/ifuid

/usr/etc/inetd

/usr/etc/netstat

/usr/etc/nfsd

/usr/etc/nfsstat

/usr/etc/ping

/usr/etc/portmap

/usr/etc/rarpd

/usr/etc/rexecd

/usr/etc/rlogind

/usr/etc/route

/usr/etc/routed

/usr/etc/rpc.bootparamd

/usr/etc/rpc.lockd

/usr/etc/rpc.mountd

/usr/etc/rpc.statd

/usr/etc/rpcinfo

/usr/etc/rshd

/usr/etc/rtnetd

/usr/etc/rwhod

/usr/etc/syslogd

/usr/etc/telnetd

/usr/etc/tftpd

/usr/etc/timed

/usr/etc/timedc

/usr/etc/timeslave

 

 


TCB Files in the /usr/gfx Directory

The files shown in Table 10-7 are found in the /usr/gfx directory:

Table 10-7. TCB Files in the /usr/gfx Directory

 

 

 

/usr/gfx/gfxinit

/usr/gfx/setmon

/usr/gfx/startgfx

/usr/gfx/stopgfx

 

 


tcb Files in the /usr/lib Directory

The files shown in Table 10-8 are found in the /usr/lib directory and its subdirectories:

Table 10-8. tcb Files in the /usr/lib Directory

 

 

 

/usr/lib/X11/xdm/Xlogin

/usr/lib/X11/xdm/Xpasswd

/usr/lib/X11/xdm/Xreset

/usr/lib/X11/xdm/Xsession

/usr/lib/X11/xdm/
Xsession-remote

/usr/lib/X11/xdm/
Xstartup

/usr/lib/X11/xdm/
Xstartup-remote

/usr/lib/accept

/usr/lib/acct/acctcms

/usr/lib/acct/acctcon1

/usr/lib/acct/acctcon2

/usr/lib/acct/acctdisk

/usr/lib/acct/acctdusg

/usr/lib/acct/acctmerg

/usr/lib/acct/accton

/usr/lib/acct/acctprc1

/usr/lib/acct/acctprc2

/usr/lib/acct/acctwtmp

/usr/lib/acct/chargefee

/usr/lib/acct/ckpacct

/usr/lib/acct/diskusg

/usr/lib/acct/dodisk

/usr/lib/acct/fwtmp

/usr/lib/acct/astlogin

/usr/lib/acct/monacct

/usr/lib/acct/nulladm

/usr/lib/acct/prctmp

/usr/lib/acct/prdaily

/usr/lib/acct/prtacct

/usr/lib/acct/ptecms.awk

/usr/lib/acct/ptelus.awk

/usr/lib/acct/remove

/usr/lib/acct/runacct

/usr/lib/acct/shutacct

/usr/lib/acct/startup

/usr/lib/acct/turnacct

/usr/lib/acct/wtmpfix

/usr/lib/diffh

/usr/lib/expreserve

/usr/lib/exrecover

/usr/lib/filetype/tagscript

/usr/lib/getcatNAME

/usr/lib/getoptcvt

/usr/lib/lpadmin

/usr/lib/lpmove

/usr/lib/lpsched

/usr/lib/lpshut

/usr/lib/lputil

/usr/lib/makewhatis

/usr/lib/mkpts

/usr/lib/reject

/usr/lib/sa/sadc

/usr/lib/sendmail

 


TCB Files in the /usr/sbin Directory

The files shown in Table 10-9 are located in the /usr/sbin directory:

Table 10-9. TCB Files in the /usr/sbin Directory

 

 

 

/usr/sbin/canonhost

/usr/sbin/distcp

/usr/sbin/gamma

/usr/sbin/gclear

/usr/sbin/gr_osview

/usr/sbin/gr_top

/usr/sbin/inst

/usr/sbin/lboot

/usr/sbin/maclbldevs

/usr/sbin/macplang

/usr/sbin/mpadmin

/usr/sbin/startconsole

/usr/sbin/sysconf

/usr/sbin/top

/usr/sbin/winterm

/usr/sbin/xshowlabel

/usr/sbin/xwsh

 


TCB Files in the /usr/spool Directory

The /usr/spool/lp/model/dumb file is located in the /usr/spool directory.

TCB Files in the /usr/sysgen/root Directory

The files shown in Table 10-10 are located in the /usr/sysgen/root directory and its subdirectories:

Table 10-10. TCB Files in the /usr/sysgen/root Directory

 

 

 

/usr/sysgen/root/lib/cpp

/usr/sysgen/root/

usr/bin/cc

/usr/sysgen/root/

usr/bin/ld

/usr/sysgen/root/

usr/lib/as1

/usr/sysgen/root/

usr/lib/ccom

/usr/sysgen/root/

usr/lib/ugen


Administrative Configuration

The administrative settings shipped with Trusted IRIX/CMW are part of the evaluated configuration.

Login Options

Trusted IRIX/CMW is shipped with a default set of login options set in the /etc/config/login.options file. If you change any of these options, you are no longer running the evaluated configuration.

Networking

As described in Chapter 4, “Networking With Trusted IRIX/CMW,” the evaluated configuration requires that you run only the tsix network software on all network interfaces. Any additional network connections violate the evaluated configuration.

Filesystems

The following information concerns filesystem configuration under Trusted IRIX/CMW.

Labeled Filesystems

All filesystems under Trusted IRIX/CMW must be labeled at all times. There are no exceptions to this rule. Even filesystems on non-trusted systems are assigned a label when connected via the network to Trusted IRIX/CMW systems.

NFS Exports

All NFS exported filesystems must be exported using the XFS extended attribute NFS extension, preserving the classifications of files across the Trusted IRIX/CMW network.

For more information, see Chapter 4, “Networking With Trusted IRIX/CMW.”

Printers

The evaluated configuration of Trusted IRIX/CMW supports printing on dumb serial printers only. For complete information, see “Printing Under Trusted IRIX/CMW.”