README the Contents Is Organized Into Following Tables
Total Page：16
File Type：pdf, Size：1020Kb
README This constitutes the Functional Specification for Red Hat Linux Enterprise 3 Update 2 AS and WS. The contents is organized into following tables. This lists the packages that constitutes the Target Of Evaluation(TOE) in the evaluated configuration of Red Hat Packages for RHEL3_EAL3: Enterprise Linux. This lists all the system calls for the Red Hat Enterprise Linux 3 kernel. It also gives information about their security relevance with respect to the Security Target , their numbers System Calls: relating to eServer series product lines, the High Level This lists the trusted programs in the Target Of Evaluation Programs with pointers to the location where they are specified. This lists the files that make up the TOE's TSF Database with Database Files pointers to the location where they are specified. Package Documentation This lists the documentation path for the packages that The documentation referenced in tables "System Calls", "Programs", and "Database Files" is the security relevant subset of the functional specification of the TOE. The TOE Security Functions Interface (TSFI ) consist of the security relevant system calls, Note: The functional specification of the TSF identified in the Security Target is provided by the description of the external interfaces (TSFI) associated with these functions. The exceptions to this rule are the following functions that cannot be descri AU.3 "Audit Record Format" TP.1 "TSF Invocation Guarantees" TP.6 "Internal TOE Protection Mechanisms" OR.1 "Object Reuse: File System Objects" OR.2 "Object Reuse: IPC Objects" OR.3 "Object Reuse: Memory Objects" provided as their respective functional description in the TOE summary specification of the Security Target. Their implementation in the High Level Design directly stems from the functional specific RED HAT is a registered trademark of Red Hat, Inc. IBM is a registered trademark of International Business Machines Corporation in the United States, other countries, or both. All other names and trademarks are the property of their respective owners. This document may be reproduced or distributed in any form without prior permission provided the copyright notice is retained on all copies. Modified versions of this document may be freely distributed, provided that they are clearly identified as such. Package Platforms package relevant to (all if blank) Comments acl amtu apmd x86 (xseries), x86_64 (eserver 325 (opteron)) ash aspell at attr authconfig autofs basesystem bash bc beecrypt bind-utils binutils bzip2 bzips-libs chkconfig comps core-utils cpio cpp cracklib cracklib-dicts crontabs cups cups-libs curl cvs cyrus-sasl cyrus-sasl-gssapi cyrus-sasl-md5 cyrus-sasl-plain db4 dev devlabel dhclient dialog diffutils dos2unix dosfstools dump e2fsprogs ed eject elfutils elfutils-libelf elinks ethtool expat elinks Package Platforms package relevant to (all if blank) Comments fbset file filesystem findutils finger fontconfig freetype ftp gawk gdbm gettext glib glib2 glibc glibc-common glibc-headers glibc-kernheaders gmp gnupg gpg-pubkey gpm grep groff grub x86 (xseries), x86_64 (eserver 325 (opteron)) gzip hdparm hesiod hotplug htmlview hwdata info initscripts iproute ipsec-tools iptables iptables-ipv6 iputils irda-utils isdn4k-utils jfsutils jwhois kbd kernel kernel-pcmcia-cs x86 (xseries), x86_64 (eserver 325 (opteron)) kernel-utils krb5-libs krb5-workstation krbafs krbafs-utils kudzu laus Package Platforms package relevant to (all if blank) Comments laus-libs less lftp lha libacl libattr libcap libgcc libgcj libjpeg libpng libstdc++ libtermcap libtiff libtool-libs libuser libwvstreams libxml2 lockdev logrotate logwatch losetup lslk lsof lvm m4 mailcap mailx make MAKEDEV man man-pages mdadm mgetty mingetty minicom mkbootdisk x86 (xseries), x86_64 (eserver 325 (opteron)) mkinitrd mktemp modutils mount mtools mtr mtr-st nano nc ncompress ncurses netconfig netdump netpbm netpbm-progs Package Platforms package relevant to (all if blank) Comments net-tools newt nfs-utils nscd nss_ldap ntsysv openldap openssh openssh-clients openssh-server Limited to these cryptographic algorithms:DES, Diffie- Hellmann, DSA, MD5, openssl RSA,SHA1, RC4 pam pam_krb5 pam_passwdqc pam_smb parted passwd patch pax pciutils pcre pdksh perl perl-DateManip perl-Filter perl-HTML-Parser perl-HTML-Tagset perl-libwww-perl perl-URI pinfo popt portmap postfix ppp prelink procmail procps psacct psmisc pspell pyOpenSSL python python-optik pyxf86config quota raidtools rdate rdist readline Package Platforms package relevant to (all if blank) Comments redhat-config-mouse redhat-config-network-tui redhat-config-securitylevel-tui redhat-logos redhat-lsb redhat-menus redhat-release rhnlib rhpl rmt rootfiles rpm rpmdb-redhat rpm-python rp-pppoe rsh rsync s390utils s390 (zSeries) schedutils sed setarch setserial setup setuptool shadow-utils sharutils slang slocate specspo star stunnel sudo symlinks sysklogd syslinux x86 (xseries), x86_64 (eserver 325 (opteron)) sysreport sysvinit talk tar tcl tcl_wrappers tcpdump tcsh telnet termcap tetex tetex-fonts tetex-latex tftp time tk tmpwatch Package Platforms package relevant to (all if blank) Comments traceroute tzdata unix2dos unzip up2date usbutils usermode utempter util-linux vconfig vim-common vim-minimal vixie-cron vsftpd wget which wireless-tools words wvdial XFree86-libs XFree86-libs-data XFree86-Mesa-libGL xinetd yaboot ppc (pseries), ppc (iseries) ypbind yp-tools zip zlib Optional Packages (Tolerated) autoconf automake bison expect expect-devel flex gcc gcc-c++ glibc-devel kernel-source krb5-devel laus-devel libattr-devel libstdc++-devel openldap-clients openssl-devel pam-devel perl-Digest-HMAC perl-Digest-SHA1 strace texinfo zlib-devel Security HLD Syscall Description Relevant TSF Privilege Module libc prototype Manpage accept a connection on a int accept(int s, struct sockaddr accept socket no no IPC *addr, socklen_t *addrlen); accept.2.gz DA.1, check user's permissions DA.2, int access(const char *pathname, access for a file yes DA.3 no FS int mode); access.2.gz switch process accounting acct on or off no admin only PC int acct(const char *filename); acct.2.gz adjtimex tune kernel clock yes SM.5 addtl PC int adjtimex(struct timex *buf); adjtimex.2.gz set an alarm clock for unsigned int alarm(unsigned int alarm delivery of a signal no no PC seconds); alarm.2.gz Set architecture specific int arch_prctl(int code, unsigned arch_prctl thread state. no no PC long addr) arch_prctl.2.gz start, flush, or tune buffer- int bdflush(int func, long bdflush dirty-flush daemon no admin only MM *address); bdflush.2.gz int bind(int sockfd, struct sockaddr *my_addr, socklen_t bind bind a name to a socket yes TP.4 addtl NI addrlen); bind.2.gz brk change data segment size yes OR.3 no MM int brk(void *end_data_segment); brk.2.gz int capget(cap_user_header_t capget set/get process capabilities no no PC header, cap_user_data_t data); capget.2.gz int capset(cap_user_header_t header, const cap_user_data_t capset set/get process capabilities yes SM.1 no PC data); capset.2.gz DA.1, DA.2, chdir change working directory yes DA.3 addtl FS int chdir(const char *path); chdir.2.gz DA.1, DA.2, change permissions of a DA.3, int chmod(const char *path, chmod file yes SM.2 addtl FS mode_t mode); chmod.2.gz Security HLD Syscall Description Relevant TSF Privilege Module libc prototype Manpage DA.1, DA.2, DA.3, int chown(const char *path, uid_t chown change ownership of a file yes SM.2 addtl FS owner, gid_t group); chown.2.gz chroot change root directory no admin only FS int chroot(const char *path); chroot.2.gz i386 : int sys_clone (struct clone Create a child process yes OR.3 no PC pt_regs regs); clone.2.gz close close a file descriptor no no FS int close(int fd); close.2.gz int connect(int sockfd, const initiate a connection on a struct sockaddr *serv_addr, connect socket no no IPC socklen_t connect.2.gz open and possibly create a int creat(const char *pathname, creat file or device yes DA.3 addtl FS mode_t mode); creat.2.gz create a loadable module caddr_t create_module(const create_module entry yes TP.3 admin only KM char *name, size_t size); create_module.2.gz long sys_delete_module (const char *name_user, unsigned int delete_module Delete a loadable module yes TP.3 admin only KM flags, delete_module.2.gz dup duplicate a file descriptor no no FS int dup(int oldfd); dup.2.gz dup2 duplicate a file descriptor no no FS int dup2(int oldfd, int newfd); dup2.2.gz DA.1, DA.2, DA.3, int execve(const char *filename, execve execute program yes TP.4 addtl PC char *const argv [], char *const execve.2.gz terminate the current exit process no no PC void _exit(int status); exit.2.gz Same as _exit(2), but kills void sys_exit_group (int exit_group all threads in the current no no PC error_code); sys_exit_group.2.gz fchdir change working directory no no FS int fchdir(int fd); fchdir.2.gz Security HLD Syscall Description Relevant TSF Privilege Module libc prototype Manpage DA.1, change permissions of a DA.3, int fchmod(int fildes, mode_t fchmod file yes SM.2 addtl FS mode); fchmod.2.gz DA.1, DA.3, int fchown(int fd, uid_t owner, fchown change ownership of a file yes SM.2 addtl FS gid_t group); fchown.2.gz fcntl manipulate file descriptor no no FS int fcntl(int fd, int cmd); fcntl.2.gz synchronize a file's in-core fdatasync data with that on disk no no FS int fdatasync(int fd); fdatasync.2.gz retrieve an extended ssize_t fgetxattr (int filedes, const fgetxattr attribute value no no FS char *name, fgetxattr.2.gz list extended attribute flistxattr names no no FS ssize_t flistxattr (int filedes,