Access to NFS Mounted Directories in Trusted Extensions
By default, NFS-mounted file systems are visible at the label of the exported
file system. If the file system is exported with read/write permissions, users at
that label can write to the files. NFS mounts that are at
a lower label than the user's current session are visible to the user,
but cannot be written to. Even if a file system is shared with
read/write permissions, the mounting system can write to it only at the label
of the mount.
To make lower-level directories that are NFS-mounted visible to users in a higher-level
zone, the administrator of the global zone on the NFS server must export
the parent directory. The parent directory is exported at its label. On the
client side, each zone must have the net_mac_aware privilege. By default, labeled zones
include the net_mac_aware privilege in their limitpriv set.
Server configuration – On the NFS server, you export the parent directory in a dfstab file. If the parent directory is in a labeled zone, the dfstab file must be modified in the labeled zone of the parent directory. The dfstab file for a labeled zone is visible only from the global zone. For the procedure, see How to Share Directories From a Labeled Zone.
Client configuration – The net_mac_aware privilege must be specified in the zone configuration file that is used during initial zone configuration. So, a user who is permitted to view all lower-level home directories must have the net_mac_aware privilege in every zone, except the lowest zone. For an example, see How to NFS Mount Files in a Labeled Zone.
Example 17-1 Providing Access to Lower-Level Home Directories
On the home directory server, the administrator creates and modifies the /zone/labeled-zone/etc/dfs/dfstab file in
every labeled zone. The dfstab file exports the /export/home directory with read/write
permissions. Thus, when the directory is mounted at the same label, the home
directory is writable. To export the /export/home directory of PUBLIC, the administrator creates a
workspace at the PUBLIC label on the home directory server, and from
the global zone, modifies the /zone/public/etc/dfs/dfstab file.
On the client, the administrator of the global zone checks that every labeled
zone, except the lowest label, has the net_mac_aware privilege. This privilege permits the
mount. This privilege can be specified by using the zonecfg command during zone
configuration. The lower-level home directory can only be viewed. MAC protects the files
in the directory from modification.
Home Directory Creation in Trusted Extensions
Home directories are a special case in Trusted Extensions. You need to
make sure that the home directories are created in every zone that a
user can use. Also, the home directory mount points must be created in
the zones on the user's system. For NFS-mounted home directories to work correctly,
the conventional location for directories, /export/home, must be used. In Trusted Extensions, the automounter
has been modified to handle home directories in every zone, that is, at
every label. For details, see Changes to the Automounter in Trusted Extensions.
Home directories are created when users are created. In Trusted Extensions, the Solaris
Management Console (Console) is used to create users, so the Console creates
the home directories. However, the Console creates the home directories in the global zone
of the home directory server. On that server, the directories are mounted by
LOFS. Home directories are automatically created by the automounter if they are specified
as LOFS mounts.
However, the automounter cannot automatically create home directories on remote NFS servers. Either
the user must first log in to the NFS server or administrative intervention
is required. To create home directories for users, see Enable Users to Access Their Home Directories in Trusted Extensions.
Changes to the Automounter in Trusted Extensions
In Trusted Extensions, each label requires a separate home directory mount. The automount
command has been modified to handle these labeled automounts. For each zone, the
automounter, autofs, mounts an auto_home_zone-name file. For example, the following is the entry for
the global zone in the auto_home_global file:
+auto_home_global
* -fstype=lofs :/export/home/&
When a zone that permits lower-level zones to be mounted is booted, the
following occurs. The home directories of lower-level zones are mounted read only under
/zone/<zone-name>/export/home. The auto_home_<zone-name> map specifies the /zone path as the source directory for
an lofs remount onto /zone/<zone-name>/home/<username>.
For example, the following is an auto_home_public entry in an auto_home_zone-at-higher-label map that is
generated from a higher-level zone:
+auto_home_public
* -fstype=lofs :/zone/public/export/home/&
The following is the corresponding entry in the public zone:
auto_home_public
* -fstype=lofs :/export/home/&
When a home directory is referenced and the name does not match
any entries in the auto_home_<zone-name> map, the map tries to match this loopback
mount specification. The software creates the home directory when the following two conditions are
met:
The map finds the match of the loopback mount specification
The home directory name matches a valid user whose home directory does not yet exist in zone-name
For details on changes to the automounter, see the automount(1M) man page.
