Zones in Trusted Extensions
A properly configured Trusted Extensions system consists of a global zone, which is
the operating system instance, and one or more labeled non-global zones. During configuration,
Trusted Extensions attaches a unique label to each zone, which creates labeled zones.
The labels come from the label_encodings file. The administrators can create a zone for
each label, but are not required to. It is possible to have more
labels than labeled zones on a system. It is not possible to
have more labeled zones than labels.
On a Trusted Extensions system, the file systems of a zone are
usually mounted as a loopback file system (lofs). All writable files and directories in
a labeled zone are at the label of the zone. By default,
a user can view files that are in a zone at a lower
label than the user's current label. This configuration enables users to view their
home directories at lower labels than the label of the current workspace. Although
users can view files at a lower label, they cannot modify them. Users
can only modify files from a process that has the same label as
In Trusted Extensions, the global zone is an administrative zone. The labeled zones
are for regular users. Users can work in a zone whose label
is within the user's accreditation range.
Every zone has an associated IP address and security attributes. A zone can
be configured with multilevel ports (MLPs). Also, a zone can be configured with
a policy for Internet Control Message Protocol (ICMP) broadcasts, such as ping.
For information about sharing directories from a labeled zone and about mounting directories
from labeled zones remotely, see Chapter 17, Managing and Mounting Files in Trusted Extensions (Tasks).
Zones in Trusted Extensions are built on the Solaris zones product. For details,
see Part II, Zones, in System Administration Guide: Virtualization Using the Solaris Operating System. In particular, patching and package installation issues affect Trusted Extensions. For details,
see Chapter 24, About Packages and Patches on a Solaris System With Zones Installed (Overview), in System Administration Guide: Virtualization Using the Solaris Operating System and Chapter 28, Troubleshooting Miscellaneous Solaris Zones Problems, in System Administration Guide: Virtualization Using the Solaris Operating System.
Zones and IP Addresses in Trusted Extensions
Your initial setup team assigned IP addresses to the global zone and the
labeled zones. Three types of configurations are documented in Creating Labeled Zones:
The system has one IP address for the global zone and all labeled zones.
This configuration is useful on a system that uses DHCP software to obtain its IP address. If no users are expected to log in, an LDAP server might have this configuration.
The system has one IP address for the global zone, and one IP address that is shared by all zones, including the global zone. Any zone can have a combination of a unique address and a shared address.
This configuration is useful on a system that regular users are going to log in to. It can also be used for a printer or an NFS server. This configuration conserves IP addresses.
The system has one IP address for the global zone, and each labeled zone has a unique IP address.
This configuration is useful for providing access to separate physical networks of single-level systems. Typically, each zone would have an IP address on a different physical network from the other labeled zones. Because this configuration is implemented with a single IP instance, the global zone controls the physical interfaces and manages global resources, such as the route table.
With the introduction of exclusive IP instances for a non-global zone, a fourth
type of configuration is available in the Solaris OS. In the Solaris Express
Community Edition, a non-global zone can be assigned its own IP instance
and manage its own physical interfaces. In this configuration, each zone operates as if
it is a distinct system. For a description, see Zone Network Interfaces in System Administration Guide: Virtualization Using the Solaris Operating System.
However, in such a configuration, each labeled zone operates as if it is
a distinct single-labeled system. The multilevel networking features of Trusted Extensions rely on
features of a shared IP stack. Administration procedures in Trusted Extensions assume that
networking is controlled entirely by the global zone. Therefore, if your initial setup
team has installed labeled zones with exclusive IP instances, you must provide or
refer to site-specific documentation.
Zones and Multilevel Ports
By default, a zone cannot send packets to and receive packets from
any other zone. Multilevel ports (MLPs) enable particular services on a port to accept
requests within a range of labels or from a set of labels.
These privileged services can reply at the label of the request. For example,
you might want to create a privileged web browser port that can listen
at all labels, but whose replies are restricted by label. By default, labeled
zones have no MLPs.
The range of labels or set of labels that constrains the packets
that the MLP can accept is based on the zone's IP address. The
IP address is assigned a remote host template in the tnrhdb database. The
label range or set of labels in the remote host template constrains the
packets that the MLP can accept.
The constraints on MLPs for different IP address configurations are as follows:
On a system where the global zone has an IP address and each labeled zone has a unique IP address, an MLP for a particular service can be added to every zone. For example, the system could be configured so that the ssh service, over TCP port 22, is an MLP in the global zone and in every labeled zone.
In a typical configuration, the global zone is assigned one IP address and labeled zones share a second IP address with the global zone. When an MLP is added to a shared interface, the service packet is routed to the labeled zone where the MLP is defined. The packet is accepted only if the remote host template for the labeled zone includes the label of the packet. If the range is ADMIN_LOW to ADMIN_HIGH, then all packets are accepted. A narrower range would discard packets that are not within the range.
At most, one zone can define a particular port to be an MLP on a shared interface. In the preceding scenario, where the ssh port is configured as a shared MLP in a non-global zone, no other zone can receive ssh connections on the shared address. However, the global zone could define the ssh port as a private MLP for receipt of connections on its zone-specific address.
On a system where the global zone and the labeled zones share an IP address, an MLP for the ssh service could be added to one zone. If the MLP for ssh is added to the global zone, then no labeled zone can add an MLP for the ssh service. Similarly, if the MLP for the ssh service is added to a labeled zone, then the global zone cannot be configured with an ssh MLP.
For an example of adding MLPs to labeled zones, see Example 19-16.
Zones and ICMP in Trusted Extensions
Networks transmit broadcast messages and send ICMP packets to systems on the network.
On a multilevel system, these transmissions could flood the system at every label.
By default, the network policy for labeled zones requires that ICMP packets be
received only at the matching label.