device_allocate man page on SunOS

Man page or keyword search:  
man Server   20652 pages
apropos Keyword Search (all sections)
Output format
SunOS logo
[printable version]

device_allocate(4)		 File Formats		    device_allocate(4)

NAME
       device_allocate - device_allocate file

SYNOPSIS
       /etc/security/device_allocate

DESCRIPTION
       The  device_allocate  file  is  an  ASCII  file	that  resides  in  the
       /etc/security directory. It contains mandatory access control  informa‐
       tion  about  each physical device. Each device is represented by a one-
       line entry of the form:

       device-name;device-type;reserved1;reserved2;auths;device-exec

       where:

       device-name

	   Represents an arbitrary ASCII string naming	the  physical  device.
	   This	 field contains no embedded white space or non-printable char‐
	   acters.

       device-type

	   Represents an arbitrary ASCII  string  naming  the  generic	device
	   type.  This	field  identifies  and groups together devices of like
	   type. This field contains no embedded white space or	 non-printable
	   characters. The following types of devices are currently managed by
	   the system: audio, sr (represents  CDROM  drives),  fd  (represents
	   floppy  drives),  st	 (represents  tape  drives), rmdisk (removable
	   media devices).

       reserved1

	   On systems configured with Trusted Extensions, this field stores  a
	   colon-separated  (:)	 list  of key-value pairs that describe device
	   allocation attributes used in Trusted Extensions. Zero or more keys
	   can	be  specified. The following keys are currently interpreted by
	   Trusted Extensions systems:

	   minlabel

	       Specifies the minimum label at which device can	be  allocated.
	       Default value is admin_low.

	   maxlabel

	       Specifies  the  maximum label at which device can be allocated.
	       Default value is admin_high.

	   zone

	       Specifies the name of the zone in  which	 device	 is  currently
	       allocated.

	   class

	       Specifies  a  logical grouping of devices. For example, all Sun
	       Ray devices of all device types. There is no default  class.

	   xdpy

	       Specifies the X display name. This is used to identify  devices
	       associated with that X session. There is no default xdpy value.

       reserved2

	   Represents a field reserved for future use.

       auths

	   Represents  a  field that contains a comma-separated list of autho‐
	   rizations required to allocate the device, an asterisk (*) to indi‐
	   cate	 that the device is not allocatable, or an '@' symbol to indi‐
	   cate that no explicit  authorization	 is  needed  to	 allocate  the
	   device.  The	 default authorization is solaris.device.allocate. See
	   auths(1).

       device-exec

	   The physical device's data clean program to be  run	any  time  the
	   device is acted on by allocate(1). This ensures that unmanaged data
	   does not remain in the physical device  between  uses.  This	 field
	   contains the filename of a program in /etc/security/lib or the full
	   pathname of a cleanup script provided by the system administrator.

   Notes on device_allocate
       The  device_allocate  file  is  an  ASCII  file	that  resides  in  the
       /etc/security directory.

       Lines in device_allocate can end with a `\' to continue an entry on the
       next line.

       Comments can also be included. A `#' makes a  comment  of  all  further
       text until the next NEWLINE not immediately preceded by a `\'.

       White space is allowed in any field.

       The  device_allocate  file  must be created by the system administrator
       before device allocation is enabled.

       The device_allocate file is owned by root, with a group of sys,	and  a
       mode of 0644.

EXAMPLES
       Example 1 Declaring an Allocatable Device

       Declare	that  physical device st0 is a type st. st is allocatable, and
       the script used to clean the  device  after  running  deallocate(1)  is
       named /etc/security/lib/st_clean.

	 # scsi tape
	 st0;\
	     st;\
	     reserved;\
	     reserved;\
	     solaris.device.allocate;\
	     /etc/security/lib/st_clean

       Example 2 Declaring an Allocatable Device with Authorizations

       Declare	that  physical	device fd0 is of type fd. fd is allocatable by
       users with the solaris.device.allocate authorization,  and  the	script
       used   to  clean	 the  device  after  running  deallocate(1)  is	 named
       /etc/security/lib/fd_clean.

	 # floppy drive
	 fd0;\
	     fd;\
	     reserved;\
	     reserved;\
	     solaris.device.allocate;\
	     /etc/security/lib/fd_clean

       Making a device allocatable means that you need to allocate and deallo‐
       cate  it to use it (with allocate(1) and deallocate(1)). If a device is
       not allocatable, there is an asterisk (*) in the auths  field,  and  no
       one can use the device.

FILES
       /etc/security/device_allocate

	   Contains list of allocatable devices

ATTRIBUTES
       See attributes(5) for descriptions of the following attributes:

       ┌─────────────────────────────┬─────────────────────────────┐
       │      ATTRIBUTE TYPE	     │	    ATTRIBUTE VALUE	   │
       ├─────────────────────────────┼─────────────────────────────┤
       │Interface Stability	     │Uncommitted		   │
       └─────────────────────────────┴─────────────────────────────┘

SEE ALSO
       auths(1),  allocate(1),	bsmconv(1M),  deallocate(1),  list_devices(1),
       auth_attr(4), attributes(5)

NOTES
       The functionality described in this  man	 page  is  available  only  if
       Solaris	Auditing  has  been enabled. See bsmconv(1M) for more informa‐
       tion.

       On systems configured with Trusted  Extensions,	the  functionality  is
       enabled	by  default.  On  such	systems,  the  device_allocate file is
       updated automatically by the system.

SunOS 5.10			  12 May 2008		    device_allocate(4)
[top]

List of man pages available for SunOS

Copyright (c) for man pages and the logo by the respective OS vendor.

For those who want to learn more, the polarhome community provides shell access and support.

[legal] [privacy] [GNU] [policy] [cookies] [netiquette] [sponsors] [FAQ]
Tweet
Polarhome, production since 1999.
Member of Polarhome portal.
Based on Fawad Halim's script.
....................................................................
Vote for polarhome
Free Shell Accounts :: the biggest list on the net