t6ext_attr(3N)t6ext_attr(3N)NAME
t6ext_attr, t6new_attr - Activate extended security attributes or set
policy on security attribute change
SYNOPSIS
cc [ flags ... ] file
#include <sys/t6attrs.h>
int t6ext_attr(int fd, t6cmd_t cmd);
int t6new_attr(int fd, t6cmd_t cmd);
DESCRIPTION
t6ext_attr turns on extended security operations on the trusted IPC
mechanism. fd is the descriptor associated with the IPC mechanism, and
cmd must be ON to turn on extended operations, or OFF to turn them off.
When first created, the trusted IPC mechanism appears the same as an
untrusted IPC mechanism. It can be used in the same way to send and
receive data as long as communications do not violate the security
policies of the system. Between systems that support mandatory access
control, for example, communications can only occur between processes at
the same sensitivity level. Before the network endpoint allows a process
to specify security attributes or manipulate the endpoint's security
options, it must call t6ext_attr. Any attempt to use extended operations
other than t6ext_err before calling this routine fails, setting errno to
the appropriate value.
t6new_attr with a value of ON for cmd tells the underlying TSIX software
that the receiving process is only interested in security attributes if
they differ from the last set of attributes it received. After this
call, t6recvfrom(3N) only returns valid security attributes when a change
in the attributes is detected. This is indicated by setting the
t6recvfrom parameter new_attrs to non-zero. When new attributes are
returned, the full set of requested attributes is returned, not just
those that have changed. When cmd is OFF, the default situation
prevails, that is, attributes are returned with each call to t6recvfrom.
CAPABILITIES
t6ext_attr requires the CAP_NETWORK_MGT capability in the effective
vector of its capability set.
ERRORS
[EINVAL] For t6new_attr, the caller did not initialize the
endpoint's security extensions prior to this call
[ENOSYS] Function not implemented as the session manager may not be
installed.
[EPERM] Operation not permitted, inadequate capabilities.
Page 1
t6ext_attr(3N)t6ext_attr(3N)SEE ALSOlibt6(3N)SOURCE
Trusted Systems Interoperability Group
NOTES
Page 2
