OBSOLETE Patch-ID# 117491-03

NOTE:
***********************************************************************
READ THE TERMS OF THE AGREEMENT ("AGREEMENT") IN THE LEGAL_LICENSE.TXT
FILE CAREFULLY BEFORE USING THIS SOFTWARE. BY USING THE SOFTWARE, YOU
AGREE TO THE TERMS OF THIS AGREEMENT. IF YOU DO NOT AGREE TO ALL OF THE
TERMS, PROMPTLY DESTROY THE UNUSED SOFTWARE.
***********************************************************************

Keywords: security ping equal label unlabeled hardened network sunscreen panic
Synopsis: Obsoleted by: 117491-04 Trusted_Solaris_8_HW_7/03_x86: genunix_policy patch
Date: Mar/10/2005


Install Requirements: Reboot immediately after patch is installed                      
                      
Solaris Release: Trusted_Solaris_8_HW_7/03_x86

SunOS Release: Trusted_Solaris_8_HW_7/03_x86

Unbundled Product: 

Unbundled Release: 

Xref: This patch available for SPARC as patch 117490

Topic: Trusted_Solaris_8_HW_7/03_x86: genunix_policy patch

Relevant Architectures: i386

BugId's fixed with this patch: 4934078 4965212 5044793 5045660 6224841

Changes incorporated in this version: 6224841

Patches accumulated and obsoleted by this patch: 

Patches which conflict with this patch: 

Patches required with this patch: 

Obsoleted by: 

Files included with this patch: 

/kernel/tsol_policy/genunix_policy
/usr/include/sys/pathname.h
/usr/include/sys/vnode_secpolicy.h

Problem Description:

6224841 panic in tsol2tnet called from tsol_labelit
 
(from 117491-02)
 
5044793 Trusted Solaris 8 can deadlock in the network stack
 
(from 117491-01)
 
4934078 users shouldn't trigger nfs net traffic for file systems they cannot access
4965212 Order of checking in tnrh_credchk complicates priv debugging
5045660 lofs somehow gets around nfs_otw checks in some corner cases

Patch Installation Instructions:
--------------------------------
Refer to the man pages for instructions on using 'patchadd' and 'patchrm'
scripts provided with Trusted Solaris. Any other special or non-generic
installation instructions should be described below as special instructions.
 
For additional examples please see the appropriate man pages.

Special Install Instructions:
-----------------------------
NOTE 1: Reboot the system after the patches are installed.
 
NOTE 2: To obtain the complete fix for 5044793 one needs to install
        the following patch:
 
        118067-01 (or greater)  ip patch
 
The steps below assume the patch has been put into an ADMIN_LOW
directory in /var/tmp and the patch file label is configured to 
ADMIN_LOW.
 
Create a role which contains the Software Installation profile
(typically admin role is assigned this profile) and whose label
range includes the ADMIN_LOW label.  All the steps in the patch
installation should be executed at ADMIN_LOW.
 
The patch should be owned by this role.
 
        1) Login as a user authorized to assume a role that contains 
           the Software Installation profile; typically the admin role.
           Assume that role.
 
           To verify the profile is assigned to the role, type:
           "profiles -l | grep patchadd".
 
           The result should be:
           /usr/sbin/patchadd    uid=0, privs=all, label=admin_low
 
        2) cd into /var/tmp and install the patch file.
 
           # cd /var/tmp
           # patchadd /var/tmp/<patch-id>
 
           where <patch-id> is the patch number.
 
 
Special Backout Instructions:
-----------------------------
NOTE 1: Reboot the system after the patches are removed.
 
        1) Login as a user authorized to assume a role that contains 
           the Software Installation profile; typically the admin role.
           Assume that role.
 
           To verify the profile is assigned to the role, type:
           "profiles -l | grep patchrm".
 
           The result should be:
           /usr/sbin/patchrm    uid=0, privs=all, label=admin_low
 
        2) Backout patch by typing:
 
           # patchrm <patch-id>
 
           where <patch-id> is the patch number.

README -- Last modified date:  Wednesday, October 26, 2005

