What’s New in Solaris 11.4?
In version 11.4, standard Solaris supports file and process labeling using the same labeling APIs and CLIs as Trusted Extensions. The labeling syntax is now the same in both standard Solaris and Trusted Extensions, and the new labelcfg
command can be used to configure labels in both environments.
However, in version 11.4, the way that label policy is enforced is very different between standard Solaris and Trusted Extensions. As an example: standard Solaris permits writing down to lower labeled objects, Trusted Extensions, by default, does not.
Likewise, the application of labels is different.
- TX applies labels to zones and network endpoints
- Standard Solaris applies labels to System V IPC objects
Additionally, while both environments support individual file labeling in ZFS, the labeling policy differences prevent the sharing of labeled file systems between standard Solaris and TX.
Finally, potentially the largest impact to current TX users, Solaris 11.4 Trusted Extensions no longer provides a multilevel desktop