Trusted Solaris
| Company type | Software |
|---|---|
| Industry | Operating systems, Computer security |
| Predecessor | Solaris |
| Founder | Sun Microsystems |
| Products | Security-evaluated operating system based on Solaris |
Trusted Solaris was a security-evaluated operating system developed by Sun Microsystems and based on Solaris. It incorporated a mandatory access control framework. Its capabilities have since been merged into the standard Solaris distribution.
Features
- Accounting capabilities
- Role-Based Access Control implementation
- Auditing mechanisms
- Device assignment management
- Mandatory access control (MAC) labeling system
- Restriction of copy and paste functions within the labeled desktop environment
Certification
Trusted Solaris 8 achieved Common Criteria certification at the Evaluation Assurance Level EAL4+ level, conforming to the CAPP, RBACPP, and LSPP protection profiles. It served as the foundation for the DoDIIS Trusted Workstation initiative.
Solaris Trusted Extensions
Capabilities once unique to Trusted Solaris, such as detailed privilege controls, have been incorporated into mainstream Solaris versions. The Solaris 10 11/06 release introduced Solaris Trusted Extensions, removing the requirement for a distinct kernel-modified edition to support labeled security environments. This functionality was also part of the OpenSolaris project.
Solaris Trusted Extensions applies mandatory access control throughout the operating system, including management of devices, files, networking, printing, and window services by assigning sensitivity labels to resources. Access is permitted solely when explicitly authorized.
Additionally, it offers a labeled security environment on the desktop level, expanding upon Trusted Solaris 8's use of the Common Desktop Environment and introducing the first labeled interface based on GNOME. This allows users to handle information at multiple classification levels within one desktop session. Although labeled desktop support was discontinued in Oracle Solaris 11.4, support for labeled zones and file/process labels continues.
The extension supports labeled device access and network communications through the Commercial Internet Protocol Security Option (CIPSO) standard, which facilitates security label exchange between labeled zones.
Oracle Solaris 11.4 brought in "File and Process Labeling," which stores labels within process credentials instead of relying on zones. This MAC policy focuses on preventing data leakage rather than enforcing traditional Multilevel_security. The ZFS filesystem accommodates per-file labeling via its multilevel dataset feature.
Common Criteria assessments that include the labeled security protection profile were successfully completed for Oracle Solaris 10 11/06 and Oracle Solaris 11.1 at EAL4+.