The policy metadata is created and resides in a protected file or named stream, depending on the current value of the metadata storage attribute and possibly the file system type.
The administrator owns key admin.pvt. The administrator must authorize the user key for policy enforcement:
%wlicertThe administrator chose identifier joe.key to represent the user's key in the WLI database.
Now /home/joe/joefile is protected against deletion and alteration.NOTE: The user and administrator can be the same person and user ID.TIP: An administrator key can create the FLAC policy.6.3 Creating an IBAC policy
In the following example, the user wants /home/joe/joefile2 accessible only through /home/joe/joe_vi. The user adjusted the group permissions for joe_vi so that only he and a specific group can execute joe_vi. The user's private key is joepriv.
User procedure:
1.Sign joe_vi:%cd /home/joe%wlisignThe administrator must authorize the user key for policy enforcement as in Section 6.2 (page 29):
%wlicert
NOTE: The keys used to sign joe_vi and create the IBAC policy are the same. This is not a requirement and the keys can be different.
Now, joefile2 can only be opened by joe_vi. Any user, including superuser, receives a “Permission denied” message if access is attempted with /usr/bin/vi or other executable.
IBAC and FLAC policies are mutually exclusive. A file can have any number of IBAC policies assigned to it, but only one IBAC.
6.4 Removing a file access policy
In the following example, the user wants to remove the FLAC policy.User procedure:
•Delete the policy:%cd /home/joe
%wlipolicyThe same key used to create the FLAC policy is necessary to delete the policy. Any user that can read the key and knows the passphrase can delete it.
6.5 Enabling DLKMs to load during boot
For this example, the system administrator identified /usr/conf/mod/ciss as a DLKM that loads during boot. The DLKM must be signed now that WLI is installed to continue to load
30 Enhancing security with WLI