'\" te
.\" Copyright (c) 2008, Sun Microsystems, Inc. All Rights Reserved.
.\" The contents of this file are subject to the terms of the Common Development and Distribution License (the "License").  You may not use this file except in compliance with the License.
.\" You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE or http://www.opensolaris.org/os/licensing.  See the License for the specific language governing permissions and limitations under the License.
.\" When distributing Covered Code, include this CDDL HEADER in each file and include the License file at usr/src/OPENSOLARIS.LICENSE.  If applicable, add the following below this CDDL HEADER, with the fields enclosed by brackets "[]" replaced with your own identifying information: Portions Copyright [yyyy] [name of copyright owner]
.TH TNCTL 8 "May 13, 2017"
.SH NAME
tnctl \- configure Trusted Extensions network parameters
.SH SYNOPSIS
.LP
.nf
\fB/usr/sbin/tnctl\fR [\fB-dfv\fR] [\fB-h\fR \fIhost\fR [/\fIprefix\fR] [:\fItemplate\fR]]
     [\fB-m\fR \fIzone\fR:\fImlp\fR:\fIshared-mlp\fR][\fB-t\fR \fItemplate\fR [:\fIkey=val\fR [;\fIkey=val\fR]]]
     [\fB-HTz\fR] \fIfile\fR]
.fi

.SH DESCRIPTION
.LP
\fBtnctl\fR provides an interface to manipulate trusted network parameters in
the Solaris kernel.
.sp
.LP
As part of Solaris Trusted Extensions initialization, \fBtnctl\fR is run in the
global zone by an \fBsmf\fR(7) script during system boot. The \fBtnctl\fR
command is not intended to be used during normal system administration.
Instead, if a local trusted networking database file is modified,
the administrator first issues
\fBtnchkdb\fR(8) to check the syntax, and then refreshes the kernel copy with
this command:
.sp
.in +2
.nf
# \fBsvcadm restart svc:/network/tnctl\fR
.fi
.in -2
.sp

.sp
.LP
See \fBWARNINGS\fR about the risks of changing remote host and template
information on a running system.
.SH OPTIONS
.ne 2
.na
\fB\fB-d\fR\fR
.ad
.sp .6
.RS 4n
Delete matching entries from the kernel. The default is to add new entries.
.sp
When deleting MLPs, the MLP range must match exactly. MLPs are specified in the
form:
.sp
.in +2
.nf
\fIport\fR[-\fIport\fR]/\fIprotocol\fR
.fi
.in -2
.sp

Where \fIport\fR can be a number in the range 1 to 65535. or any known service
(see \fBservices\fR(5)), and protocol can be a number in the range 1 to 255, or
any known protocol (see \fBprotocols\fR(5)).
.RE

.sp
.ne 2
.na
\fB\fB-f\fR\fR
.ad
.sp .6
.RS 4n
Flush all kernel entries before loading the entries that are specified on the
command line. The flush does not take place unless at least one entry parsed
successfully.
.RE

.sp
.ne 2
.na
\fB\fB-v\fR\fR
.ad
.sp .6
.RS 4n
Turn on verbose mode.
.RE

.sp
.ne 2
.na
\fB\fB-h\fR \fIhost\fR[/\fIprefix\fR][:\fItemplate\fR]\fR
.ad
.sp .6
.RS 4n
Update the kernel remote-host cache on the local host for the specified
\fIhost\fR or, if a template name is given, change the kernel's cache to use
the specified \fItemplate\fR. If \fIprefix\fR is not specified, then an implied
prefix length is determined according to the rules used for interpreting the
\fBtnrhdb\fR. If \fB-d\fR is specified, then a template name cannot be
specified.
.RE

.sp
.ne 2
.na
\fB\fB-m\fR \fIzone\fR:\fImlp\fR:\fIshared-mlp\fR\fR
.ad
.sp .6
.RS 4n
Modify the kernel's multilevel port (MLP) configuration cache for the specified
\fIzone\fR. \fIzone\fR specifies the zone to be updated. \fImlp\fR and
\fIshared-mlp\fR specify the MLPs for the zone-specific and shared IP
addresses. The \fIshared-mlp\fR field is effective in the global zone only.
.RE

.sp
.ne 2
.na
\fB\fB-t\fR \fItemplate\fR[\fIkey=val\fR[;\fIkey=val\fR]]\fR
.ad
.sp .6
.RS 4n
Update the kernel template cache for \fItemplate\fR or, if a list of
\fIkey=val\fR pairs is given, change the kernel's cache to use the specified
entry. If \fB-d\fR is specified, then \fIkey=val\fR pairs cannot be specified.
.RE

.sp
.ne 2
.na
\fB\fB-T\fR \fIfile\fR\fR
.ad
.sp .6
.RS 4n
Load all template entries in \fIfile\fR into the kernel cache.
.RE

.sp
.ne 2
.na
\fB\fB-H\fR \fIfile\fR\fR
.ad
.sp .6
.RS 4n
Load all remote host entries in \fIfile\fR into the kernel cache.
.RE

.sp
.ne 2
.na
\fB\fB-z\fR \fIfile\fR\fR
.ad
.sp .6
.RS 4n
Load just the global zone's MLPs from \fIfile\fR into the kernel cache. To
reload MLPs for a non-global zone, reboot the zone:
.sp
.in +2
.nf
# \fBzoneadm -z\fR \fInon-global zone\fR \fBreboot\fR
.fi
.in -2
.sp

.RE

.SH ATTRIBUTES
.LP
See \fBattributes\fR(7) for descriptions of the following attributes:
.sp

.sp
.TS
box;
c | c
l | l .
ATTRIBUTE TYPE	ATTRIBUTE VALUE
_
Interface Stability	Uncommitted
.TE

.SH FILES
.ne 2
.na
\fB\fB/etc/security/tsol/tnrhdb\fR\fR
.ad
.sp .6
.RS 4n
Trusted network remote-host database
.RE

.sp
.ne 2
.na
\fB\fB/etc/security/tsol/tnrhtp\fR\fR
.ad
.sp .6
.RS 4n
Trusted network remote-host templates
.RE

.sp
.ne 2
.na
\fB\fB/etc/security/tsol/tnzonecfg\fR\fR
.ad
.sp .6
.RS 4n
Trusted zone configuration database
.RE

.sp
.ne 2
.na
\fB\fB/etc/nsswitch.conf\fR\fR
.ad
.sp .6
.RS 4n
Configuration file for the name service switch
.RE

.SH SEE ALSO
.LP
.BR svcs (1),
.BR nsswitch.conf (5),
.BR protocols (5),
.BR services (5),
.BR attributes (7),
.BR smf (7),
.BR svcadm (8),
.BR tnchkdb (8),
.BR tnd (8),
.BR tninfo (8),
.BR zoneadm (8)
.sp
.LP
\fIHow to Synchronize Kernel Cache With Network Databases\fR in \fISolaris
Trusted Extensions Administrator\&'s Procedures\fR
.SH WARNINGS
.LP
Changing a template while the network is up can change the security view of an
undetermined number of hosts.
.SH NOTES
.LP
The functionality described on this manual page is available only if the system
is configured with Trusted Extensions.
.sp
.LP
The \fBtnctl\fR service is managed by the service management facility,
\fBsmf\fR(7), under the service identifier:
.sp
.in +2
.nf
svc:/network/tnctl
.fi
.in -2
.sp

.sp
.LP
The service's status can be queried by using \fBsvcs\fR(1). Administrative
actions on this service, such as refreshing the kernel cache, can be performed
using \fBsvcadm\fR(8), as in:
.sp
.in +2
.nf
svcadm restart svc:/network/tnctl
.fi
.in -2
.sp