Developer's Guide to Oracle^® Solaris 11.4 Security

Exit Print View

Document Information

Using This Documentation

Product Documentation Library

Feedback

Chapter 1 Oracle Solaris Security for Developers (Overview)

What's New in Security Features for Developers in Oracle Solaris 11.4

Overview of Oracle Solaris Security Features for Developers

System Security

Security Extensions Framework

Using the sxadm Command to Manage Security Extensions

Debugging When Using Security Extensions

Network Security Architecture

Chapter 2 Developing Privileged Applications

Privileged Applications

About Privileges

How Administrators Assign Privileges

How Privileges Are Implemented

Permitted Privilege Set

Inheritable Privilege Set

Limit Privilege Set

Effective Privilege Set

Compatibility Between the Superuser and Privilege Models

Privilege Categories

Programming with Privileges

Privilege Data Types

Privilege Interfaces

setppriv() for Setting Privileges

priv_str_to_set() for Mapping Privileges

Privilege Coding Example

Privilege Bracketing in the Superuser Model

Privilege Bracketing in the Least Privilege Model

Guidelines for Developing Privileged Applications

About Authorizations

Chapter 3 Writing PAM Applications and Services

Introduction to the PAM Framework

PAM Service Modules

PAM Library

PAM Authentication Process

Requirements for PAM Consumers

PAM Configuration

Writing Applications That Use PAM Services

Simple PAM Consumer Example

Useful PAM Functions

Writing Conversation Functions

Writing Modules That Provide PAM Services

Requirements for PAM Service Providers

Sample PAM Provider Service Module

Chapter 4 Writing Applications That Use GSS-API

Introduction to GSS-API

Application Portability With GSS-API

Security Services in GSS-API

Available Mechanisms in GSS-API

Remote Procedure Calls With GSS-API

Limitations of GSS-API

Language Bindings for GSS-API

Where to Get More Information on GSS-API

Important Elements of GSS-API

GSS-API Data Types

GSS-API Integers

Strings and Similar Data in GSS-API

Names in GSS-API

Comparing Names in GSS-API

GSS-API OIDs

GSS-API Status Codes

GSS-API Tokens

Interprocess Tokens in GSS-API

Developing Applications That Use GSS-API

Generalized GSS-API Usage

Working With Credentials in GSS-API

Acquiring Credentials in GSS-API

Working With Contexts in GSS-API

Initiating a Context in GSS-API

Accepting a Context in GSS-API

Using Other Context Services in GSS-API

Delegating a Credential in GSS-API

Performing Mutual Authentication Between Peers in GSS-API

Performing Anonymous Authentication in GSS-API

Using Channel Bindings in GSS-API

Exporting and Importing Contexts in GSS-API

Obtaining Context Information in GSS-API

Sending Protected Data in GSS-API

Tagging Messages With gss_get_mic()

Wrapping Messages With gss_wrap()

Handling Wrap Size Issues in GSS-API

Detecting Sequence Problems in GSS-API

Confirming Message Transmission in GSS-API

Cleaning Up a GSS-API Session

Chapter 5 GSS-API Client Example

GSSAPI Client Example Overview

GSSAPI Client Example Structure

Running the GSSAPI Client Example

GSSAPI Client Example: main() Function

Opening a Connection With the Server

Establishing a Security Context With the Server

Translating a Service Name into GSS-API Format

Establishing a Security Context for GSS-API

Miscellaneous GSSAPI Context Operations onthe Client Side

Wrapping and Sending a Message

Reading and Verifying a Signature Block Froma GSS-API Client

Deleting the Security Context

Chapter 6 GSS-API Server Example

GSSAPI Server Example Overview

GSSAPI Server Example Structure

Running the GSSAPI Server Example

GSSAPI Server Example: main() Function

Acquiring Credentials

Checking for inetd

Receiving Data From a Client

Accepting a Context

Unwrapping the Message

Signing and Returning the Message

Using the test_import_export_context() Function

Cleaning Up the GSSAPI Server Example

Chapter 7 Introduction to the Oracle Solaris Cryptographic Framework

Oracle Solaris Cryptography Terminology

Overview of the Cryptographic Framework

Components of the Cryptographic Framework

What Cryptography Developers Need to Know

Requirements for Developers of User-Level Consumers

Requirements for Developers of User-Level Providers

Chapter 8 Writing User-Level Cryptographic Applications

Overview of the Cryptoki Library

PKCS #11 Function List

Functions for Using PKCS #11

PKCS #11 Functions: C_Initialize()

PKCS #11 Functions: C_GetInfo()

PKCS #11 Functions: C_GetSlotList()

PKCS #11 Functions: C_GetTokenInfo()

PKCS #11 Functions: C_OpenSession()

PKCS #11 Functions: C_GetMechanismList()

Extended PKCS #11 Functions

SUNW_C_GetMechSession() Extended PKCS #11 Function

SUNW_C_KeyToObject() Extended PKCS #11 Function

User-Level Cryptographic Application Examples

Message Digest Example

Symmetric Encryption Example

Sign and Verify Example

Random Byte Generation Example

Chapter 9 Introduction to the Oracle Solaris Key Management Framework

Oracle Solaris Key Management FrameworkFeatures

Oracle Solaris Key Management Framework Components

KMF Key Management Tool

KMF Policy Enforcement Mechanisms

KMF Application Programming Interfaces

Oracle Solaris Key Management FrameworkExample Application

KMF Headers and Libraries

KMF Basic Data Types

KMF Application Results Verification

Complete KMF Application Source Code

Appendix A Secure Coding Guidelines for Developers

Appendix B Sample C-Based GSS-API Programs

Client-Side GSS-API Application

Server-Side GSS-API Application

Miscellaneous GSS-API Sample Functions

Appendix C GSS-API Reference

GSS-API Functions

Functions From Previous Versions of GSS-API

Functions for Manipulating s

Renamed GSS-API Functions

GSS-API Status Codes

GSS-API Major Status Code Values

Displaying GSS-API Status Codes

GSS-API Status Code Macros

GSS-API Data Types and Values

Basic GSS-API Data Types

OM_uint32 Data Type

gss_buffer_desc Data Type

gss_OID_desc Data Type

gss_OID_set_desc Data Type

gss_channel_bindings_struct Data Type

GSS-API Name Types

GSS-API Address Types for Channel Bindings

Implementation-Specific Features in GSS-API

Oracle Solaris-Specific Functions

Human-Readable GSS-API Name Syntax

GSS-API Format of Anonymous Names

Implementations of Selected GSS-API Data Types

Deletion of GSS-API Contexts and Stored Data

Protection of GSS-API Channel-Binding Information

GSS-API Context Exportation and Interprocess Tokens

Types of Credentials That GSS-API Supports

Credential Expiration in GSS-API

GSS-API Context Expiration

GSS-API Wrap Size Limits and QOP Values

Use of minor_status Parameter in GSS-API

Kerberos v5 Status Codes

Messages Returned in Kerberos v5 for Status Code 1

Messages Returned in Kerberos v5 for Status Code 2

Messages Returned in Kerberos v5 for Status Code 3

Messages Returned in Kerberos v5 for Status Code 4

Messages Returned in Kerberos v5 for Status Code 5

Messages Returned in Kerberos v5 for Status Code 6

Messages Returned in Kerberos v5 for Status Code 7

Appendix D Specifying an OID

Files with OID Values

/etc/gss/mech File

/etc/gss/qop File

gss_str_to_oid() Function

Constructing Mechanism OIDs

createMechOid() Function

Specifying a Non-Default Mechanism

Appendix E Security Considerations When Using C Functions

Movatterモバイル変換

Developer's Guide to Oracle® Solaris 11.4 Security

Developing Privileged Applications

Developer's Guide to Oracle^® Solaris 11.4 Security