Chapter 8. Trusted IRIX/CMW System Data Files
Prev |  | Next

## Chapter 8. Trusted IRIX/CMW System Data Files

The Trusted IRIX/CMW system relies on a number of administrative data files to provide crucial information for the system. It is the job of the system administrator to keep these files correct and up to date.

| Note: The `covici` command can be used to maintain the administrative data files under revision control. For more information see the `covici`(1) man page.

This chapter contains a list of the system data files found under the Trusted IRIX/CMW system and their formats and functions.

The outline format used in this chapter for describing each administrative data file is as follows:

Pathname: |  | The complete pathname of the file.
Description: |  | A complete description of the purpose of the file.
Syntax: |  | The syntax of a record or entry in the file.
MAC Label: |  | The default Mandatory Access Control (MAC) label associated with the file. A MAC label has two symmetric parts; the Mandatory Sensitivity (MSEN) portion and the Mandatory Integrity (MINT) portion, separated by a slash character (/).
DAC Permission: |  | The default Discretionary Access Control (DAC) permissions associated with the file.

Sections in this chapter include:

- “Home Directory Files”

- “Files in the /var Directory Structure”

- “Files in the /dev Directory Structure”

- “Files in the /etc Directory Structure”

- “Files in the /etc/config Directory Structure”

- “Fields in the /etc/mac File”

- “Files in the /usr Directory Structure”

## Home Directory Files

The files described in this section are present in the home directory of each user. The MAC label of these files should be the minimum MAC label of the user.

### .rhosts

Pathname: |  | `~/.rhosts`
Description: |  | This file contains a list of hosts from which this user is allowed to initiate a remote session without additional authentication. For more information see the `rhosts`(4) man page.
Syntax: |  | command hostname username
MAC Label: |  | `dblow`
DAC Permission: |  | -rw-r--r-- (644) root,sys

### .sgisession

Pathname: |  | `~/.sgisession`
Description: |  | Applications placed in this file will be executed when the user logs in. For more information see the Desktop User's Guide.
Syntax: |  | command
MAC Label: |  |
DAC Permission: |  | -rw-r--r-- (644) root,sys

## Files in the /var Directory Structure

The following files reside in the `/var` directory structure.

### /var/adm/lastlog/username

Pathname: |  | `/var/adm/lastlog/`username
Description: |  | These files record information for use by the `login` program about your last login.
Syntax: |  | A typical `lastlog` file might look like:
    ^A(:4ujohnsmith.other.place.com
MAC Label: |  | `dblow`
DAC Permission: |  | -rw-r--r-- (644) root,sys

### /var/adm/SYSLOG

Pathname: |  | `/var/adm/SYSLOG`
Description: |  | This file contains a log of all events corresponding to those selected in the `/etc/syslog.conf` file. For more information see the `syslog`(3C) man page.
Syntax: |  | A typical `SYSLOG` file looks like:
    Sep 2 01:01:39 mymachine syslogd: restart
    Sep 3 09:58:35 mymachine sendmail[21326]: AA21326:
    from=, size=2266, class=0
    Sep 3 10:02:32 mymachine sendmail[21336]: AA21336:
    from=, size=1605, class=0
    Sep 3 10:07:15 mymachine sendmail[21342]: AA21342:
    from=, size=2202, class=0
MAC Label: |  | `dbadmin`
DAC Permission: |  | -rw-r--r-- (644) root,sys

### /var/adm/oSYSLOG

Pathname: |  | `/var/adm/oSYSLOG`
Description: |  | This file is a saved old version of the system log. For more information see the `syslog`(3C) man page.
Syntax: |  | A typical `oSYSLOG` has records of the form:
    Sep 2 01:01:38 mymachine syslogd: restart
    Sep 3 15:26:12 mymachine sendmail[15324]: AA15324:
    from=, size=1027, class=0
    Sep 3 17:14:02 mymachine sendmail[15424]: AA15424:
    from=, size=1080, class=0
    Sep 3 17:44:03 mymachine sendmail[15461]: AA15461:
    from=, size=974, class=0
MAC Label: |  | `dbadmin`
DAC Permission: |  | -rw-r--r-- (644) root,sys

### /var/adm/OLDsulog

Pathname: |  | `/var/adm/OLDsulog`
Description: |  | This file is used for backups of the `sulog` file. For more information see the `sulog`(4) man page.
Syntax: |  | Each entry in `OLDsulog` has the following form:
    SU 09/09 10:21 + ttyq2 invoking user-new identity
MAC Label: |  | `dbadmin`
DAC Permission: |  | -rw------- (600) root,sys

### /var/adm/sulog

Pathname: |  | `/var/adm/sulog`
Description: |  | This file contains a log of all uses of the `su` command. For more information see the `sulog`(4) man page.
Syntax: |  | Each entry in `sulog` has the following form:
    SU 09/09 10:21 + ttyq2 invoking user-new identity
MAC Label: |  | `dbadmin`
DAC Permission: |  | -rw------- (600) root,sys

### /var/adm/utmp

Pathname: |  | `/var/adm/utmp`
Description: |  | This file holds user information for such commands as `who`, `write`, and `login`. For more information about this file, see the `utmp`(4) man page.
Syntax: |  | Example:
    struct utmp {
    char ut_user[8]; /*User login name*/
    char ut_id[4]; /*/etc/inittab id usually line #)*/
    char ut_line[12]; /* device name (console,lnxx)*/
    short ut_pid; /*process id*/
    short ut_type; /* type of entry */
    struct exit_status {
    ~~~~short ~~~~e_termination;/*termination status*/
    ~~~~short ~~~~e_exit; /* Process exit status */
    }ut_exit; /*exit status of a process marked */
    /* as a DEAD_PROCESS.*/
    time_t ut_time; /* time entry was made */
    };
MAC Label: |  | `dblow`
DAC Permission: |  | -rw-r--r-- (644) root,sys

### /var/adm/wtmp

Pathname: |  | `/var/adm/wtmp`
Description: |  | This file contains one record per username with related information: `inittab` ID, device name connected to, process ID, type of entry (for example, a login process), exit status, and time the entry was made. For more information about this file see the `utmp`(4) man page.
Syntax: |  | Example:
    struct utmp {
    char ut_user[8]; /* User login name */
    char ut_id[4]; /*/etc/inittab id usually line #*/
    char ut_line[12]; /* device name (console,lnxx) */
    short ut_pid; /* process id */
    short ut_type; /* type of entry */
    struct exit_status {
    ~~~~short ~~~~e_termination;/*termination status*/
    ~~~~short ~~~~e_exit; /* Process exit status */
    } ut_exit; /* The exit status of a process marked as DEAD_PROCESS. */
    time_t ut_time; /* time entry was made */
    };
MAC Label: |  | wildcard
DAC Permission: |  | -rw-rw-r-- (664) root,sys

### /var/spool/lp/pstatus

Pathname: |  | `/var/spool/lp/pstatus`
Description: |  | Printer status information is stored in this file. For more information see the `lpstat`(1) man page.
Syntax: |  | Data file.
MAC Label: |  | `dbadmin`
DAC Permission: |  | -rw-r--r-- (644) lp,sys

### /var/spool/lp/qstatus

Pathname: |  | `/var/spool/lp/qstatus`
Description: |  | Print queue status information is stored in this file. For more information see the `lpstat`(1) man page.
Syntax: |  | Data file.
MAC Label: |  | `dbadmin`
DAC Permission: |  | -rw-r--r-- (644) lp,sys

## Files in the /dev Directory Structure

The following files reside in the special `/dev` directory structure. These device files control the physical hardware.

### /dev/console

Pathname: |  | `/dev/console`
Description: |  | The console provides the operator interface to the system. The operating system and system utility programs display error messages on the system console. The console is a logical terminal represented by a text window on the graphics monitor. The evaluated configuration does not support the option of using a serial terminal. The device special file `/dev/console` represents the system console. `/dev/console` is the slave side of pseudo-tty (see the `pty`(7) man page).
Syntax: |  | Special device file.
MAC Label: |  | `dblow`
DAC Permission: |  | crw--w--w- (622) root,sys

### /dev/klog

Pathname: |  | `/dev/klog`
Description: |  | This the kernel error logging interface. When this device is open, messages printed by the kernel, which normally appear only in the system console window, also are buffered by the `klog` driver. The messages obtained by reading from this driver are the text of the kernel error messages. Normally, this device is opened and read by `syslogd`, the system logging daemon. For more information see the `klog`(7) man page.
Syntax: |  | Special device file.
MAC Label: |  | `dblow`
DAC Permission: |  | crw-r--r-- (644) root,sys

### /dev/kmem

Pathname: |  | `/dev/kmem`
Description: |  | This is a special file that is an image of the kernel virtual memory of the computer. It may be used, for example, to examine and even to patch the system memory. For more information see the `kmem`(7) man page.
MAC Label: |  | `dblow`
DAC Permission: |  | crw-r----- (640) root,sys

### /dev/log

Pathname: |  | `/dev/log`
Description: |  | This file is a named pipe that is read by `syslogd` as a source of system log messages. If a program writes error messages to `/dev/log`, `syslogd` receives the messages and places them in the system log. For more information see the `log`(7) man page.
Syntax |  | Named pipe.
MAC Label: |  | wildcard
DAC Permission: |  | prw-rw-rw- (666) root,sys

### /dev/ptc

Pathname: |  | `/dev/ptc`
Description: |  | This file is the clonable pseudo-tty. For more information see the `clone`(7) man page.
MAC Label: |  | wildcard
DAC Permission: |  | crw-rw-rw- (666) root,sys

### /dev/tty

Pathname: |  | `/dev/tty`
Description: |  | This file is, in each process, a synonym for the control terminal associated with the process group of that process, if any. For more information see the `tty`(1) man page.
MAC Label: |  | wildcard
DAC Permission: |  | crw-rw-rw- (666) root,sys

## Files in the /etc Directory Structure

The following files reside in the `/etc` directory structure.

### /etc/TIMEZONE

Pathname: |  | `/etc/TIMEZONE`
Description: |  | This file contains the time zone (for example, EST), the hours of difference between the time zone and Greenwich time zone (for example, 5), and the alternative time zone (for example, EDT). All the information is in one line without any field separators. For more information see the `timezone`(4) man page.
Syntax: |  | TZ=timezone hours_from_GMT daylight_timezone
MAC Label: |  | `dblow`
DAC Permission: |  | -rw-r--r-- (644) root,sys

### /etc/aliases

Pathname: |  | `/etc/aliases`
Description: |  | This file contains the user and group aliases used by `sendmail`. For more information about this file see the `aliases`(4) man page.
Syntax: |  |
MAC Label: |  | `dblow`
DAC Permission: |  | -rw-r--r-- (644) root,sys

### /etc/capability

Pathname: |  | `/etc/capability`
Description: |  | This file specifies the capabilities allowed for each user account on the system. Capabilities allow a process to perform a specific set of restricted operations without granting privileged access to the entire system. This file contains the following information for each account:
name | User's login name—contains no uppercase characters and must not be longer than eight characters.
capabilities | The various capabilities that the user is allowed.
|  | For more information see the `capability`(4) man page.
Syntax: |  | The following is a sample `capability` file:
    root:all+eip:all+eip
    sysadm:all=:all=
    auditor:CAP_AUDIT_WRITE,CAP_AUDIT_CONTROL,CAP_KILL+eip
    dbadmin:all=:all=
    ernie:all=:CAP_FOWNER,CAP_SETFCAP+eip
    casey:all=:all+eip
MAC Label: |  | `dblow`
DAC Permission: |  | -rw-r--r-- (644) root,sys

### /etc/clearance

Pathname: |  | `/etc/clearance`
Description: |  | This is the user label file. This file contains the following information for each user:
name | User's login name—contains no uppercase characters and must not be longer than eight characters.
default security label | The default label assigned to the user if no label is specified.
minimum security label | The lowest security label that the user is allowed.
maximum security label | The highest security label that the user is allowed.
|  | For more information see the `clearance`(4) man page.
Syntax: |  | The following is a sample `clearance` file:
    root:dblow:dblow...dbadmin
    bill:userlow:userlow...userhigh
MAC Label: |  | `dblow`
DAC Permission: |  | -rw-r--r-- (644) root,sys

### /etc/cshrc

Pathname: |  | `/etc/cshrc`
Description: |  | This file is the prototype `.cshrc`.
Syntax: |  | This file contains a sample of C-shell initialization commands. It is used as the default set of commands. For more information see the `csh`(1) man page.
MAC Label: |  | `dblow`
DAC Permission: |  | -rw-r--r-- (644) root,sys

### /etc/exports

Pathname: |  | `/etc/exports`
Description: |  | This file describes the filesystem exported to NFS clients. For more information see the `exports`(4) man page.
Syntax: |  |
MAC Label: |  | `dblow`
DAC Permission: |  | -rw-r--r-- (644) root,sys

### /etc/fstab

Pathname: |  | `/etc/fstab`
Description: |  | This file describes the filesystems and swapping partitions used by the local machine. For more information see the `fstab`(4) man page.
Syntax: |  |
MAC Label: |  | `dblow`
DAC Permission: |  | -rw-r--r-- (644) root,sys

### /etc/gettydefs

Pathname: |  | `/etc/gettydefs`
Description: |  | This file contains information used by `getty` to set up the speed and terminal settings for a serial line. This file supplies information on what the `login` prompt should look like. It also supplies the speed to try next if the user indicates the current speed is not correct by typing a break character. For more information see the `getty`(1M) man page.
Syntax: |  | label# initial-flags # final-flags # login-prompt #next-label
MAC Label: |  | `dblow`
DAC Permission: |  | -rw-r--r-- (644) root,sys

### /etc/group

Pathname: |  | `/etc/group`
Description: |  | This file is the definition file for user groups on the system. For more information see the `group`(4) man page,
Syntax: |  | groupname:epasswd:GID:[user1,user2]
MAC Label: |  | `dblow`
DAC Permission: |  | -rw-r--r-- (644) root,sys
Dependencies: |  | `/etc/passwd`

### /etc/hosts

Pathname: |  | `/etc/hosts`
Description: |  | This file contains information regarding the known hosts on the network. For more information see the `hosts`(4) man page.
Syntax: |  | IP-address hostname alias[es]
MAC Label: |  | `dblow`
DAC Permission: |  | -rw-r--r-- (644) root,sys

### /etc/hosts.equiv

Pathname: |  | `/etc/hosts.equiv`
Description: |  | This file contains a list of trusted hosts. When an `rlogin`, `rcp`, or `rsh` request from a listed host is made and the initiator of the request is also listed in the `/etc/passwd` file, no further validity checking is done as long as the login name and user ID number of the user on the remote host are identical to the listing in the local `/etc/passwd` file. If these conditions are met, `rlogin` does not prompt for a password, and `rcp`, and `rsh` complete successfully. So a remote user is “equivalenced” to a local user with the same user name and user ID number when the remote user's host name is found in `hosts.equiv`.
|  | For more information see the `host.equiv`(4) man page.
Syntax: |  | hostname
MAC Label: |  | `dblow`
DAC Permission: |  | -rw-r--r-- (644) root,sys

### /etc/ioctl.syscon

Pathname: |  | `/etc/ioctl.syscon`
Description: |  | This file defines the state of the console device. When `init` comes up at boot time, and whenever it switches out of single-user state to normal run states, it sets the `ioctl` states of the virtual console, `/dev/console`, to those modes saved in the file `/etc/ioctl.syscon`. This file is written by `init` whenever the single-user state is entered.
Syntax: |  | `d26:1805:8bf:3b:0:3:1c:8:18:4:0:0:0:0:0:0`
MAC Label: |  | `dblow`
DAC Permission: |  | -rw-r--r-- (644) root,sys
Referenced by: |  | `init`
Modified by: |  | `init`

### /etc/inetd.conf

Pathname: |  | `/etc/inetd.conf`
Description: |  | This configuration file is read by `inetd` to control network services. For more information see the `inetd`(1M) man page.
MAC Label: |  | `dblow`
DAC Permission: |  | -rw-r--r-- (644) root,sys

### /etc/inittab

Pathname: |  | `/etc/inittab`
Description: |  | This file supplies the script to the `init` command's role as a general process dispatcher. The majority of `init`'s process dispatching activity involves creating instances of the terminal line process, `/etc/getty`. Other processes typically dispatched by `init` are daemons and shells. For more information see the `inittab`(4) man page.
Syntax: |  | id:rstate:action:process
MAC Label: |  | `dblow`
DAC Permission: |  | -rw-r--r-- (644) root,sys

### /etc/mail/submit.cf

Pathname: |  | /`etc/mail/submit.cf`
Description: |  | This is the configuration file for the mail submission program which is used to submit Emails as invoked by programs (or users). For more information about this file, see the `sendmail`(8) man page.
MAC Label: |  | `dblow`
DAC Permission: |  | -rw-r--r-- (644) root,sys

### /etc/motd

Pathname: |  | `/etc/motd`
Description: |  | This file is used for the “Message of the Day.” The system administrator can freely edit this file. The `/etc/motd` file is displayed each time a user logs in. For more information see the `motd`(4) man page.
Syntax: |  | ASCII text file.
MAC Label: |  | `dblow`
DAC Permission: |  | -rw-r--r-- (644) root,sys

### /etc/nologin

Pathname: |  | `/etc/nologin`
Description: |  | If the file is present, remote user logins via the network are not permitted.
Syntax: |  | There is no syntax to this file. The existence of the file is all that is required.
MAC Label: |  | `dblow`
DAC Permission: |  | -r--r--r-- (444) root,sys
Dependencies: |  | `login`
Referenced by: |  | `login`

### /etc/opasswd

Pathname: |  | `/etc/opasswd`
Description: |  | This file is a backup copy of `/etc/passwd`.
Syntax: |  | username:e_passwd[,Mmww|lock_char]:UID:GID:GECOS: $HOME:$SHELL
MAC Label: |  | `dblow`
DAC Permission: |  | -rw-r--r-- (644) root,sys

### /etc/passwd

Pathname: |  | `/etc/passwd`
Description: |  | This file contains information about the user. For trusted systems, the encrypted password should not be stored in this file. The encrypted password is kept in `/etc/shadow`. The `passwd` file contains the following information for each user:
name | User's login name contains no uppercase characters and must not be greater than eight characters long.
unused | The field that is normally occupied by the password is unused.
numerical user ID | This is the user's ID in the system and it must be unique.
numerical group ID | This is the number of the group that the user belongs to.
user's real name | In some versions of UNIX, this field also contains the user's office location, extension, home phone, and so on.
initial working directory | The directory that the user is in at login. This is known as the ``home'' directory.
shell | The program to use as the command interpreter (“shell”) when the user logs in. If the shell field is empty, the Bourne shell (`/bin/sh`) is assumed.
|  | For more information see the `passwd`(1) man page.
Syntax: |  | username::UID:GID:GECOS: $HOME:$SHELL
MAC Label: |  | `dblow`
DAC Permission: |  | -rw-r--r-- (644) root,sys

### /etc/profile

Pathname: |  | `/etc/profile`
Description: |  | This file is the prototype shell environment command file for use with `/bin/sh`. Commands in this file are executed when the shell starts up. For more information see the `profile`(4) man page.
Syntax: |  | ASCII text file.
MAC Label: |  | `dblow`
DAC Permission: |  | -rw-r--r-- (644) root,sys

### /etc/resolv.conf

Pathname: |  | `/etc/resolv.conf`
Description: |  | This configuration file has several functions. It defines the default domain or the default domain search list. It specifies the ordering of host resolution services used by `gethostbyname` and `gethostbyaddr`. It lists Internet addresses of name servers. For more information see the `resolv.conf`(4) man page.
MAC Label: |  | `dblow`
DAC Permission: |  | -rw-r--r-- (644) root,sys

### /etc/rhost.conf

Pathname: |  | `/etc/rhost.conf`
Description: |  | This file is the configuration file for the remote login and remote shell programs. It specifies the parameters under which remote logins and shells are allowed on your system from systems that share your security policy and those that do not. Default capability sets and allowed login labels are specified here. For more information see the`rhost`(1M) man page.
MAC Label: |  | `dblow`
DAC Permission: |  | -rw------- (600) root,sys

### /etc/sendmail.cf

Pathname: |  | /`etc/sendmail.cf`
Description: |  | This is the configuration file for `sendmail` running as the mail transmission agent. It is used in conjunction with the auto configuration script `configmail`. For more information about this file, see the `sendmail`(8) man page.
MAC Label: |  | `dblow`
DAC Permission: |  | -rw-r--r-- (644) root,sys

### /etc/services

Pathname: |  | /`etc/services`
Description: |  | The `/etc/services` file contains information regarding the known services available in the Internet. For more information see the `services`(4) man page.
Syntax: |  | Example syntax:
    smtp 25/tcp mail
MAC Label: |  | `dblow`
DAC Permission: |  | -rw-r--r-- (644) root,sys

### /etc/shadow

Pathname: |  | `/etc/shadow`
Description: |  | This is the user password file. This file contains the following information for each user:
name | User's login name—contains no uppercase characters and must not be longer than eight characters.
password | Encrypted password and optional password aging information
|  | For more information see the `shadow`(4) man page.
Syntax: |  | The following is a sample `shadow` file:
    root:kEXFeXFTPoxE
    bill:6k/7KCFRPNVXg,z/
MAC Label: |  | `dblow`
DAC Permission: |  | -rw------- (600) root,sys

### /etc/sys_id

Pathname: |  | `/etc/sys_id`
Description: |  | This file contains the name by which the system is known on the network. For more information see the `sys_id`(4) man page.
Syntax: |  | hostname
MAC Label: |  | `dblow`
DAC Permission: |  | -rw-r--r-- (644) root,sys

### /etc/syslog.conf

Pathname: |  | `/etc/syslog.conf`
Description: |  | This file directs the system log daemon (`syslogd`) to log messages in a given set of files. Each log message in a logfile is one line. For more information about this file see the `syslogd`(1M) man page.
Syntax: |  | An example `syslog.conf` file:
    kern.debug |/usr/adm/klogpp /usr/adm/SYSLOG
    kern.debug |/usr/adm/klogpp /dev/console
    daemon,auth,syslog,lpr.debug /usr/adm/SYSLOG
    kern.err @ginger
    *.emerg *
    *.alert eric,beth
    *.alert;auth.warning ralph
MAC Label: |  | `dblow`
DAC Permission: |  | -rw-r--r-- (644) root,sys

### /etc/ttytype

Pathname: |  | `/etc/ttytype`
Description: |  | This file contains a list of the tty ports on the system and, for each port, the kind of terminal that is attached to it. For more information see the `ttytype`(4) man page.
Syntax: |  | Example:
    iris-ansi console
    iris-ansi systty
    vt100 ttyd1
    ?h19 ttyd2
    ?h19 ttyd3
    ?v50am ttyd4
    ?v50am ttyd5
    ?v50am ttyd6
    ?v50am ttyd7
    ?v50am ttyd8
    ?v50am ttyd9
    ?v50am ttyd10
    ?v50am ttyd11
    ?v50am ttyd12
MAC Label: |  | `dblow`
DAC Permission: |  | -rw-r--r-- (644) root,sys

## Files in the /etc/config Directory Structure

All files in the `/etc/config` directory that lack suffixes contain only the words ``on'' or ``off.'' This indicates whether or not the named subsystem is activated at system startup time. Files with the suffix “.options” contain flags to the subsystem startup command.

### /etc/config/acct

Pathname: |  | `/etc/config/acct`
Description: |  | This file contains either the word “on” or “off.” If it contains “on,” process accounting is turned on by default. If it contains the word “off,” process accounting is not run by default. For more information about this file see the `acct`(1M) man page.
Syntax: |  | The word “on” or “off.”
MAC Label: |  | `dblow`
DAC Permission: |  | -rw-r--r-- (644) root,sys

### /etc/config/automount

Pathname: |  | /`etc/config/automount`
Description: |  | This file is used by the system to direct NFS to automatically mount network filesystems or not to mount them. For more information about this file see the `automount`(1M) man page.
Syntax: |  | The word “on” or “off.”
MAC Label: |  | `dblow`
DAC Permission: |  | -rw-r--r-- (644) root,sys

### /etc/config/automount.options

Pathname: |  | /`etc/config/automount.options`
Description: |  | This file contains the command-line options used by the `automount` command. For more information about this file see the `automount`(1M) man page.
MAC Label: |  | `dblow`
DAC Permission: |  | -r--r--r-- (444) root,sys

### /etc/config/login

Pathname: |  | `/etc/default/config`
Description: |  | This file controls the default actions of the `login` program, such as the number of unsuccessful attempts to log in or the timeout period while waiting for a password. This file is described in the `login`(4) man page.
Syntax: |  | Example:
    maxtries=5
    disabletime=30
    passwdreq
MAC Label: |  | `dblow`
DAC Permission: |  | -rw-r--r-- (644) root,sys

### /etc/config/named

Pathname: |  | `/etc/config/named`
Description: |  | This file directs the system to spawn or not to spawn the `named` domain name server. For more information about this file see the `named`(1M) man page.
Syntax: |  | The word “on” or “off.”
MAC Label: |  | `dblow`
DAC Permission: |  | -rw-r--r-- (644) root,sys

### /etc/config/network

Pathname: |  | `/etc/config/network`
Description: |  | This file is used by the system to direct NFS to spawn the lock and status daemons or not to spawn them. For more information about this file see the `network`(1M) man page.
Syntax: |  | The word “on” or “off.”
MAC Label: |  | `dblow`
DAC Permission: |  | -rw-r--r-- (644) root,sys

### /etc/config/nfs

Pathname: |  | `/etc/config/nfs`
Description: |  | This file is used by the system to start the NFS daemons and mount the network filesystems. For more information about this file see the`nfs`(4) man page.
Syntax: |  | The word “on” or “off.”
MAC Label: |  | `dblow`
DAC Permission: |  | -rw-r--r-- (644) root,sys
Referenced by: |  | `init`

### /etc/config/rwhod

Pathname: |  | `/etc/config/rwhod`
Description: |  | This file directs the system to spawn or not to spawn the `rwhod` server daemon. For more information about this file see the `rwhod`(1M) man page.
Syntax: |  | The word “on” or “off.”
MAC Label: |  | `dblow`
DAC Permission: |  | -rw-r--r-- (644) root,sys

### /etc/config/satd.options

Pathname: |  | `/etc/config/satd.options`
Description: |  | This option file contains saved `satd` options. A flag to `satd` fills this file with the current `satd` options.
MAC Label: |  | `dblow`
DAC Permission: |  | -rw-r--r-- (644) root,sys

### /etc/config/sat_select.options

Pathname: |  | `/etc/config/sat_select.options`
Description: |  | This file contains saved options to `sat_select`. A flag to `sat_select` fills this file with the current `sat_select` options. For more information about this file see the `sat_select`(1M) man page.
MAC Label: |  | `dblow`
DAC Permission: |  | -rw-r--r-- (644) root,sys

### /etc/config/syslogd.options

Pathname: |  | `/etc/config/syslogd.options`
Description: |  | This file contains command line options for the `syslogd` program. `syslogd` reads and logs messages into a set of files. For information about the `syslogd` program see the `syslogd`(1M) man page.
Syntax: |  | Optional site-specific flags belong in the options file. The available flags are: `-f` – Specify an alternate configuration file. `-m` – Select the number of minutes between mark messages. `-d` – Turn on debugging. `-p` – Use the given name for the named pipe instead of `/dev/log`.
MAC Label: |  | `dblow`
DAC Permission: |  | -rw-r--r-- (644) root,sys

### /etc/config/timed

Pathname: |  | `/etc/config/timed`
Description: |  | This file directs the system to spawn or not to spawn the `timed` clock controlling daemon. For more information about `timed`, see the `timed`(1M) man page.
Syntax: |  | The word “on” or “off.”
MAC Label: |  | `dblow`
DAC Permission: |  | -rw-r--r-- (644) root,sys

### /etc/config/timed.options

Pathname: |  | `/etc/config/timed.options`
Description: |  | This file contains the default optional flags used by `timed`, the time daemon used to synchronize the host's time with the time of other machines in a local area network. For more information see the `timed`(1M) man page.
Syntax: |  | Default:
    -G timelords -P /var/adm/timetrim
MAC Label: |  | `dblow`
DAC Permission: |  | -rw-r--r-- (644) root,sys

## Fields in the /etc/mac File

The `/etc/mac` file contains seven fields: `categorynames`, `divisionnames`, `gradenames`, `labelnames`, `levelnames`, `minttypenames`, and `msentypenames`. All fields have three parts separated by colons: name, type, and value. All numerical values must be hexadecimal, with no leading zeros in the significant digits. For example, 0x77 is legal, but 0x077 and 156 are not legal.

The `/etc/mac` file has the following label and permission:

MAC Label: |  | `dblow`
DAC Permission: |  | -rw-r--r-- (644) root,sys

### categorynames

Description: |  | This field associates a human readable text name with the category number. Typically, the category number is used to identify projects or areas (categories) of information. A category allows labels to have the same sensitivity level (such as `proprietary`) but different security labels by having different categories (such as a category named `cashew` and a category named `pistachio`).
Syntax: |  | A `categorynames` field might look like:
    black:category:0xa
    blue:category:0xb
    green:category:0x3f
    lavender:category:0x6e
    orange:category:0x3c
    pink:category:0x96
    purple:category:0x97
    red:category:0xaa
    violet:category:0xd2
    white:category:0xdc

### divisionnames

Description: |  | This field associates a human readable text name with the division number. The division number is a non-hierarchical value that indicates a grade type that this label includes. Typically, the division number is used to identify projects or areas (categories) of integrity. A division allows labels to have the same grade (such as `highest grade`), and to have different security labels by having different divisions (such as a division named `cookie` and a division named `fudge`).
Syntax: |  | A `divisionnames` field might look like this:
    IRIXsuperuser:division:0x1
    IRIXdbadmin:division:0x2
    IRIXinit:division:0x3
    apple pie:division:0x65
    cake:division:0x78
    chocolate:division:0x79
    cookie:division:0x7a
    custard:division:0x7c
    fudge:division:0x96

### gradenames

Description: |  | This field associates a human readable ASCII text name with the grade value. The grade value is a hierarchical value that indicates how trustworthy the label is. For example, the grade could have names such as `Dubious`, `Suspect`, `Normal`, `Confident`, `Verified`, `TheTruth`, and so on.
Syntax: |  | A `gradenames` field might look like this:
    lowestgrade:grade:0x1
    lowest grade:grade:0x1
    good:grade:0x1c
    choice:grade:0x50
    prime:grade:0xfe
    best:grade:0xff
    highestgrade:grade:0x10
    highest grade:grade:0x10

### labelnames

Description: |  | This field defines all the possible security labels in an ASCII text format. It associates an ASCII text name with a security label. This field defines the name of the security label, and the MSEN type, sensitivity level, MINT type, grade, categories and divisions. Interpretation of this field relies on the `msentypenames`, `levelnames`, `minttypenames`, `gradenames`, `categorynames`, and `divisionnames` data files to define components that are specified by name rather than by number.
Syntax: |  | A `labelnames` field might look like this:
    label1:alias:”msenlow/minthigh”
    label2:alias:msenlow/mintlow
    label3:alias:msentcsec,proprietary/minbiba,best

### levelnames

Description: |  | This field associates a human readable ASCII text name with the sensitivity level value. The sensitivity level is a hierarchical value that indicates how sensitive the label is. For example, the sensitivity level could have names such as `Sensitive`, `Classified`, `Secret`, `Top Secret`, and so on.
Syntax: |  | A typical `levelnames` field looks something like this:
    # This is a comment line.
    public:level:0x69
    proprietary:level:0x2e
    company sensitive:leve:0x28
    company confidential:level:0x32
    executive committee only:level:0x33

### minttypenames

Description: |  | This field maps the MINT (Mandatory Integrity) type of a security label from an ASCII name to the numeric value.
Syntax: |  | The default `minttypenames` field on your system looks like this:
    MintBiba:minttype:0x62
    MintEqual:minttype:0x65
    MintHigh:minttype:0x68
    MintLow:minttype:0x6c

### msentypenames

Description: |  | This field maps the MSEN type of a security label from an ASCII name to the numeric value.
Syntax: |  | The default `msentypenames` field on your system looks like this:
    MsenAdmin:msentype:0x41
    MsenEqual:msentype:0x45
    MsenHigh:msentype:0x48
    MsenMldHigh:msentype:0x49
    MsenLow:msentype:0x4c
    MsenMld:msentype:0x4d
    MsenMldLow:msentype:0x4e
    MsenTcsec:msentype:0x54

## Files in the /usr Directory Structure

The following files reside in the `/usr` directory structure.

### /usr/lib/X11/xdm/Xresources

Pathname: |  | `/usr/lib/X11/xdm/Xresources`
Description: |  | This file contains default information about your X environment. For more information see the `XDM`(1) man page.
Syntax: |  | The default `Xresources` file looks like this:
    xlogin*login.translations: #override
    <key> F1: set-session-argument(failsafe) finish-field()
    <key> Return: set-session-argument() finish-field()
    xlogin*borderWidth: 3
    #ifdef COLOR
    xlogin*greetColor: #f63
    xlogin*failColor: red
    xlogin*Foreground: black
    xlogin*Background: #fdc
    #else
    xlogin*Foreground: black
    xlogin*Background: white
    #endif
MAC Label: |  | `dblow`
DAC Permission: |  | -r--r--r-- (444) root,sys

Prev | Table of Contents | Next
Chapter 7. Administering Identification and Authentication |  | Chapter 9. Administering Printing and Tape Devices