If you intend to run the evaluated configuration of Trusted IRIX/CMW at your site, you should be aware that there are strict limits placed on the hardware and software that have been evaluated. This chapter defines the evaluated configuration. If anything is added to, modified in, or subtracted from the evaluated configuration as described in this chapter, you are no longer running the evaluated configuration. Your system may operate normally, but the configuration has not been tested for security.
Trusted IRIX/CMW is under evaluation and the evaluated hardware list has not been finalized at the time of publication. However, Trusted IRIX/CMW runs on the entire Silicon Graphics family of workstations and servers.
The following peripheral devices are being evaluated with Trusted IRIX/CMW:
| External SCSI tape drive | | |
| Serial (dumb) printers | | |
| Network connections | |
The Trusted IRIX/CMW software must be kept intact and used as directed to maintain the evaluated configuration. The sections below detail the evaluated software.
Only software that is part of the evaluated TCB shipped with Trusted IRIX/CMW may use the minthigh integrity label. This level of integrity requires formal security evaluation. If you change the integrity grade of any other file to minthigh, you are no longer running the evaluated configuration.
The symbolic link files shown in Table 10-1 provide additional names for the referenced programs.
Table 10-1. Linked Files in the TCB
Symbolic Link Name | Referenced Program Name |
|---|---|
bin/4d | /bin/true |
bin/4d60 | /bin/true |
bin/[ | /bin/test |
bin/chgrp | /bin/chown |
bin/cp | /bin/ln |
bin/m68000 | /bin/false |
bin/m68k | /bin/false |
bin/mips | /bin/true |
bin/multgrps | /bin/newgrp |
bin/mv | /bin/ln |
bin/pdp11 | /bin/false |
bin/printenv | /bin/env |
bin/red | /bin/ed |
bin/rsh | /bin/sh |
bin/u3b | /bin/false |
bin/u3b15 | /bin/false |
bin/u3b2 | /bin/false |
bin/u3b5 | /bin/false |
bin/vax | /bin/false |
etc/autoconfig | /etc/init.d/autoconfig |
etc/devnm | /bin/df |
etc/rc0.d/K15cron | /etc/init.d/cron |
etc/rc0.d/K20mail | /etc/init.d/mail |
etc/rc0.d/K22acct | /etc/init.d/acct |
etc/rc0.d/K25lp | /etc/init.d/lp |
etc/rc0.d/K28audit | /etc/init.d/audit |
etc/rc0.d/K39network | /etc/init.d/network.local |
etc/rc0.d/K40network | /etc/init.d/network |
etc/rc0.d/K90sysetup | /etc/init.d/sysetup |
etc/rc2.d/S01MOUNTFSYS | /etc/init.d/MOUNTFSYS |
etc/rc2.d/S20sysetup | /etc/init.d/sysetup |
etc/rc2.d/S21perf | /etc/init.d/perf |
etc/rc2.d/S22acct | /etc/init.d/acct |
etc/rc2.d/S25audit | /etc/init.d/audit |
etc/rc2.d/S30network | /etc/init.d/network |
etc/rc2.d/S31network | /etc/init.d/network.local |
etc/rc2.d/S48savecore | /etc/init.d/savecore |
etc/rc2.d/S50mail | /etc/init.d/mail |
etc/rc2.d/S58RMTMPFILES | /etc/init.d/RMTMPFILES |
etc/rc2.d/S60lp | /etc/init.d/lp |
etc/rc2.d/S75cron | /etc/init.d/cron |
etc/rc2.d/S83audio | /etc/init.d/audio |
etc/rc2.d/S88configmsg | /etc/init.d/configmsg |
etc/rc2.d/S95autoconfig | /etc/init.d/autoconfig |
etc/rc2.d/S98xdm | /etc/init.d/xdm |
etc/telinit | /etc/init |
usr/bin/apropos | /usr/bin/man |
usr/bin/awk | /usr/bin/oawk |
usr/bin/page | /usr/bsd/more |
usr/bin/pcat | /usr/bin/unpack |
usr/bin/whatis | /usr/bin/man |
usr/bin/whoami | /usr/bin/id |
usr/bsd/uncompress | /usr/bsd/compress |
usr/bsd/uptime | /usr/bsd/w |
usr/bsd/zcat | /usr/bsd/compress |
usr/gfx/gfxinfo | /usr/gfx/gfxinit |
usr/lib/cpp | /lib/cpp |
usr/sbin/confirm | /usr/bin/X11/xconfirm |
usr/sbin/inform | /usr/bin/X11/xconfirm |
usr/sbin/pathconf | /usr/sbin/sysconf |
usr/sbin/sgikopt | /etc/nvram |
usr/sbin/versions | /usr/sbin/inst |
usr/sysgen/root/usr/lib/cpp | /usr/sysgen/root/lib/cpp |
The following sections list the files and programs that make up the Trusted IRIX/CMW Trusted Computing Base (TCB).
The files shown in Table 10-2 are found in the /bin directory
Table 10-2. TCB Files in the /bin Directory
|
|
|
|---|---|---|
/bin/acctcom | /bin/basename | /bin/cat |
/bin/chlabel | /bin/chmod | /bin/chown |
/bin/cmp | /bin/date | /bin/dbedit |
/bin/df | /bin/diff | /bin/dirname |
/bin/echo | /bin/ed | /bin/env |
/bin/expr | /bin/false | /bin/file |
/bin/find | /bin/grep | /bin/hinv |
/bin/ipcrm | /bin/ipcs | /bin/kill |
/bin/line | /bin/ln | /bin/login |
/bin/ls | /bin/mail | /bin/make |
/bin/mkdir | /bin/mklbldb | /bin/mt |
/bin/newgrp | /bin/newlabel | /bin/newpsoacl |
/bin/nice | /bin/passwd | /bin/passwd_gen.off |
/bin/pr | /bin/ps | /bin/psoacl |
/bin/pwd | /bin/rm | /bin/rmdir |
/bin/sat_echo | /bin/sat_interpret | bin/sat_reduce |
/bin/sat_select | /bin/sat_summarize | /bin/satd |
/bin/sed | /bin/sh | /bin/showlastlogin |
/bin/showpwage | /bin/sleep | /bin/sort |
/bin/stty | /bin/su | /bin/sum |
/bin/sync | /bin/tail | /bin/tar |
/bin/test | /bin/touch | /bin/true |
/bin/tset | /bin/tty | /bin/uname |
/bin/wc | /bin/who |
|
The files shown in Table 10-3 are found in the /etc directory and its subdirectories:
Table 10-3. TCB Files in the /etc/directory
|
|
|
|---|---|---|
/etc/bcheckrc | /etc/brc | /etc/capability |
/etc/chkconfig | /etc/chroot | /etc/clearance |
/etc/config/netif.options | /etc/cron | /etc/cshrc |
/etc/dfsck | /etc/dvhtool | /etc/fsck |
/etc/fsstat | /etc/fstyp.d/fstyp.efs | /etc/fuser |
/etc/getty | /etc/growfs | /etc/grpck |
/etc/halt | /etc/havenfs | /etc/init |
/etc/init.d/MOUNTFSYS | /etc/init.d/RMTMPFILES | /etc/init.d/acct |
/etc/init.d/audio | /etc/init.d/audit | /etc/init.d/autoconfig |
/etc/init.d/configmsg | /etc/init.d/cron | /etc/init.d/lp |
/etc/init.d/mail | /etc/init.d/network | /etc/init.d/network.local |
/etc/init.d/perf | /etc/init.d/savecore | /etc/init.d/sysetup |
/etc/init.d/xdm | /etc/install | /etc/killall |
/etc/labelit | /etc/lnsyscon | /etc/lvck |
/etc/lvinfo | /etc/lvinit | /etc/mkfs |
/etc/mklv | /etc/mknod | /etc/mount |
/etc/mountall | /etc/multi | /etc/mvdir |
/etc/ncheck | /etc/nvram | /etc/profile |
/etc/pwck | /etc/rc0 | /etc/rc2 |
/etc/rc3 | /etc/reboot | /etc/renice |
/etc/role | /etc/savecore | /etc/setmnt |
/etc/shadow | /etc/showmount | /etc/shutdown |
/etc/single | /etc/stdcshrc | /etc/stdlogin |
/etc/stdprofile | /etc/swap | /etc/uadmin |
/etc/umount | /etc/userck | /etc/wall |
The /usr/adm/.profile and /usr/adm/klogpp files are found in the /usr/adm directory.
The files shown in Table 10-4 are found in the /usr/bin directory and its subdirectories:
Table 10-4. TCB Files in the /usr/bin Directory
|
|
|
|---|---|---|
/usr/bin/X11/4Dwm | /usr/bin/X11/X | /usr/bin/X11/Xsgi |
/usr/bin/X11/appdefpath | /usr/bin/X11/endsession | /usr/bin/X11/mkfontdir |
/usr/bin/X11/reaper | /usr/bin/X11/resize | /usr/bin/X11/tellwm |
/usr/bin/X11/toolchest | /usr/bin/X11/userenv | /usr/bin/X11/wait4m |
/usr/bin/X11/xclock | /usr/bin/X11/xconfirm | /usr/bin/X11/xdm |
/usr/bin/X11/xdpyinfo | /usr/bin/X11/xhost | /usr/bin/X11/xlistscrns |
/usr/bin/X11/xprop | /usr/bin/X11/xrdb | /usr/bin/X11/xrefresh |
/usr/bin/X11/xset | /usr/bin/X11/xsetroot | /usr/bin/X11/xterm |
/usr/bin/at | /usr/bin/banner | /usr/bin/batch |
/usr/bin/cancel | /usr/bin/chrtbl | /usr/bin/col |
/usr/bin/crontab | /usr/bin/cut | /usr/bin/disable |
/usr/bin/enable | /usr/bin/fx | /usr/bin/getopt |
/usr/bin/id | /usr/bin/lp | /usr/bin/lpstat |
/usr/bin/man | /usr/bin/oawk | /usr/bin/rlp |
/usr/bin/ul | /usr/bin/uniq | /usr/bin/unpack |
/usr/bin/xargs |
|
|
The files shown in Table 10-5 are found in the /usr/bsd directory:
Table 10-5. TCB Files in the /usr/bsd Directory
|
|
|
|---|---|---|
/usr/bsd/compress | /usr/bsd/ftp | /usr/bsd/head |
/usr/bsd/hostid | /usr/bsd/hostname | /usr/bsd/logger |
/usr/bsd/more | /usr/bsd/nslookup | /usr/bsd/rcp |
/usr/bsd/rlogin | /usr/bsd/rsh | /usr/bsd/telnet |
/usr/bsd/w |
|
|
The files shown in Table 10-6 are found in the /usr/etc directory and its subdirectories:
Table 10-6. TCB Files in the /usr/etc Directory
|
|
|
|---|---|---|
/usr/etc/arp | /usr/etc/audio/dsploader | /usr/etc/automount |
/usr/etc/biod | /usr/etc/configmail | /usr/etc/dgld |
/usr/etc/exportfs | /usr/etc/fsr | /usr/etc/ftpd |
/usr/etc/ifconfig | /usr/etc/iflabel | /usr/etc/ifuid |
/usr/etc/inetd | /usr/etc/netstat | /usr/etc/nfsd |
/usr/etc/nfsstat | /usr/etc/ping | /usr/etc/portmap |
/usr/etc/rarpd | /usr/etc/rexecd | /usr/etc/rlogind |
/usr/etc/route | /usr/etc/routed | /usr/etc/rpc.bootparamd |
/usr/etc/rpc.lockd | /usr/etc/rpc.mountd | /usr/etc/rpc.statd |
/usr/etc/rpcinfo | /usr/etc/rshd | /usr/etc/rtnetd |
/usr/etc/rwhod | /usr/etc/syslogd | /usr/etc/telnetd |
/usr/etc/tftpd | /usr/etc/timed | /usr/etc/timedc |
/usr/etc/timeslave |
|
|
The files shown in Table 10-7 are found in the /usr/gfx directory:
Table 10-7. TCB Files in the /usr/gfx Directory
|
|
|
|---|---|---|
/usr/gfx/gfxinit | /usr/gfx/setmon | /usr/gfx/startgfx |
/usr/gfx/stopgfx |
|
|
The files shown in Table 10-8 are found in the /usr/lib directory and its subdirectories:
Table 10-8. tcb Files in the /usr/lib Directory
|
|
|
|---|---|---|
/usr/lib/X11/xdm/Xlogin | /usr/lib/X11/xdm/Xpasswd | /usr/lib/X11/xdm/Xreset |
/usr/lib/X11/xdm/Xsession | /usr/lib/X11/xdm/ | /usr/lib/X11/xdm/ |
/usr/lib/X11/xdm/ | /usr/lib/accept | /usr/lib/acct/acctcms |
/usr/lib/acct/acctcon1 | /usr/lib/acct/acctcon2 | /usr/lib/acct/acctdisk |
/usr/lib/acct/acctdusg | /usr/lib/acct/acctmerg | /usr/lib/acct/accton |
/usr/lib/acct/acctprc1 | /usr/lib/acct/acctprc2 | /usr/lib/acct/acctwtmp |
/usr/lib/acct/chargefee | /usr/lib/acct/ckpacct | /usr/lib/acct/diskusg |
/usr/lib/acct/dodisk | /usr/lib/acct/fwtmp | /usr/lib/acct/astlogin |
/usr/lib/acct/monacct | /usr/lib/acct/nulladm | /usr/lib/acct/prctmp |
/usr/lib/acct/prdaily | /usr/lib/acct/prtacct | /usr/lib/acct/ptecms.awk |
/usr/lib/acct/ptelus.awk | /usr/lib/acct/remove | /usr/lib/acct/runacct |
/usr/lib/acct/shutacct | /usr/lib/acct/startup | /usr/lib/acct/turnacct |
/usr/lib/acct/wtmpfix | /usr/lib/diffh | /usr/lib/expreserve |
/usr/lib/exrecover | /usr/lib/filetype/tagscript | /usr/lib/getcatNAME |
/usr/lib/getoptcvt | /usr/lib/lpadmin | /usr/lib/lpmove |
/usr/lib/lpsched | /usr/lib/lpshut | /usr/lib/lputil |
/usr/lib/makewhatis | /usr/lib/mkpts | /usr/lib/reject |
/usr/lib/sa/sadc | /usr/lib/sendmail |
|
The files shown in Table 10-9 are located in the /usr/sbin directory:
Table 10-9. TCB Files in the /usr/sbin Directory
|
|
|
|---|---|---|
/usr/sbin/canonhost | /usr/sbin/distcp | /usr/sbin/gamma |
/usr/sbin/gclear | /usr/sbin/gr_osview | /usr/sbin/gr_top |
/usr/sbin/inst | /usr/sbin/lboot | /usr/sbin/maclbldevs |
/usr/sbin/macplang | /usr/sbin/mpadmin | /usr/sbin/startconsole |
/usr/sbin/sysconf | /usr/sbin/top | /usr/sbin/winterm |
/usr/sbin/xshowlabel | /usr/sbin/xwsh |
|
The /usr/spool/lp/model/dumb file is located in the /usr/spool directory.
The files shown in Table 10-10 are located in the /usr/sysgen/root directory and its subdirectories:
Table 10-10. TCB Files in the /usr/sysgen/root Directory
|
|
|
|---|---|---|
/usr/sysgen/root/lib/cpp | /usr/sysgen/root/ usr/bin/cc | /usr/sysgen/root/ usr/bin/ld |
/usr/sysgen/root/ usr/lib/as1 | /usr/sysgen/root/ usr/lib/ccom | /usr/sysgen/root/ usr/lib/ugen |
The administrative settings shipped with Trusted IRIX/CMW are part of the evaluated configuration.
Trusted IRIX/CMW is shipped with a default set of login options set in the /etc/config/login.options file. If you change any of these options, you are no longer running the evaluated configuration.
As described in Chapter 4, “Networking With Trusted IRIX/CMW,” the evaluated configuration requires that you run only the tsix network software on all network interfaces. Any additional network connections violate the evaluated configuration.
The following information concerns filesystem configuration under Trusted IRIX/CMW.
All filesystems under Trusted IRIX/CMW must be labeled at all times. There are no exceptions to this rule. Even filesystems on non-trusted systems are assigned a label when connected via the network to Trusted IRIX/CMW systems.
All NFS exported filesystems must be exported using the XFS extended attribute NFS extension, preserving the classifications of files across the Trusted IRIX/CMW network.
For more information, see Chapter 4, “Networking With Trusted IRIX/CMW.”
The evaluated configuration of Trusted IRIX/CMW supports printing on dumb serial printers only. For complete information, see “Printing Under Trusted IRIX/CMW.”