<html><head><meta name="color-scheme" content="light dark"></head><body><pre style="word-wrap: break-word; white-space: pre-wrap;">Patch-ID# 121551-02

NOTE:
***********************************************************************
READ THE TERMS OF THE AGREEMENT ("AGREEMENT") IN THE LEGAL_LICENSE.TXT
FILE CAREFULLY BEFORE USING THIS SOFTWARE. BY USING THE SOFTWARE, YOU
AGREE TO THE TERMS OF THIS AGREEMENT. IF YOU DO NOT AGREE TO ALL OF THE
TERMS, PROMPTLY DESTROY THE UNUSED SOFTWARE.
***********************************************************************

Keywords: security hang privileges nfs cipso
Synopsis: Trusted_Solaris_8_2/04: genunix_policy patch
Date: Jun/28/2006


Install Requirements: Reboot immediately after patch is installed                      
                      
Solaris Release: Trusted_Solaris_8_2/04

SunOS Release: Trusted_Solaris_8_2/04

Unbundled Product: 

Unbundled Release: 

Xref: This patch available for x86 as patch 121552

Topic: Trusted_Solaris_8_2/04: genunix_policy patch

Relevant Architectures: sparc

BugId's fixed with this patch: 6332123 6407106

Changes incorporated in this version: 6407106

Patches accumulated and obsoleted by this patch: 

Patches which conflict with this patch: 

Patches required with this patch: 

Obsoleted by: 

Files included with this patch: 

/kernel/tsol_policy/genunix_policy
/kernel/tsol_policy/sparcv9/genunix_policy

Problem Description:

6407106 Fix for 6332123 breaks CIPSO endpoints in TS8
 
(from 121551-01)
 
6332123 denial of service attack can hang system in trusted networking

Patch Installation Instructions:
--------------------------------
 
For Solaris 2.0-2.6 releases, refer to the Install.info file and/or
the README within the patch for instructions on using the generic
'installpatch' and 'backoutpatch' scripts provided with each patch.
 
For Solaris 7-10 releases, refer to the man pages for instructions
on using 'patchadd' and 'patchrm' scripts provided with Solaris.
Any other special or non-generic installation instructions should be
described below as special instructions.  The following example
installs a patch to a standalone machine:
 
       example# patchadd /var/spool/patch/104945-02
 
The following example removes a patch from a standalone system:
 
       example# patchrm 104945-02
 
For additional examples please see the appropriate man pages.

Special Install Instructions:
-----------------------------
NOTE 1: Reboot immediately after you finish patch installation
 
The steps below assume the patch has been put into an ADMIN_LOW
directory in /var/tmp and the patch file label is configured to ADMIN_LOW.
 
Create a role which contains the Software Installation profile
(typically admin role is assigned this profile) and whose label
range includes the ADMIN_LOW label.  All the steps in the patch
installation should be executed at ADMIN_LOW.
 
The patch should be owned by this role.
 
        1) Login as a user authorized to assume a role that contains the
        Software Installation profile; typically the admin role.
        Assume that role.
 
        To verify the profile is assigned to the role, type:
        "profiles -l | grep patchadd".
 
        The result should be:
         /usr/sbin/patchadd    uid=0, privs=all, label=admin_low
 
        2) cd into /var/tmp and install the patch file.
 
        # cd /var/tmp
        # patchadd /var/tmp/&lt;patch-id&gt;
 
        where &lt;patch-id&gt; is the patch number.
 
Special Backout Instructions:
-----------------------------
NOTE 1: Reboot immediately after patch removal.
 
        1) Login as a user authorized to assume a role that contains the
        Software Installation profile; typically the admin role.
        Assume that role.
 
        To verify the profile is assigned to the role, type:
        "profiles -l | grep patchrm".
 
        The result should be:
        /usr/sbin/patchrm    uid=0, privs=all, label=admin_low
 
        2) Backout patch by typing:
 
        # patchrm &lt;patch-id&gt;
 
        where &lt;patch-id&gt; is the patch number.

README -- Last modified date:  Wednesday, June 28, 2006

</pre></body></html>