<?xml version="1.0"?> <!DOCTYPE service_bundle SYSTEM "/usr/share/lib/xml/dtd/service_bundle.dtd.1"> <!-- Copyright 2007 Sun Microsystems, Inc. All rights reserved. Use is subject to license terms. CDDL HEADER START The contents of this file are subject to the terms of the Common Development and Distribution License (the "License"). You may not use this file except in compliance with the License. You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE or http://www.opensolaris.org/os/licensing. See the License for the specific language governing permissions and limitations under the License. When distributing Covered Code, include this CDDL HEADER in each file and include the License file at usr/src/OPENSOLARIS.LICENSE. If applicable, add the following below this CDDL HEADER, with the fields enclosed by brackets "[]" replaced with your own identifying information: Portions Copyright [yyyy] [name of copyright owner] CDDL HEADER END ident "%Z%%M% %I% %E% SMI" NOTE: This service manifest is not editable; its contents will be overwritten by package or patch operations, including operating system upgrade. Make customizations in a different file. --> <service_bundle type='manifest' name='SUNWcsr:policy'> <service name='network/ipsec/policy' type='service' version='1'> <!-- The 'policy' service is delivered enabled for backwards compatability with existing adminstrative proceedure. --> <create_default_instance enabled='true' /> <single_instance /> <!-- Read/Write access to /var/run required for lock files --> <dependency name='filesystem' grouping='require_all' restart_on='none' type='service'> <service_fmri value='svc:/system/filesystem/minimal' /> </dependency> <!-- Kernel needs to know supported IPsec algorithms --> <dependency name='algorithms' grouping='require_all' restart_on='none' type='service'> <service_fmri value='svc:/network/ipsec/ipsecalgs' /> </dependency> <!-- General networking services should not start untill IPsec policy has been configured. --> <dependent name='policy-network' grouping='optional_all' restart_on='none'> <service_fmri value='svc:/milestone/network' /> </dependent> <exec_method type='method' name='start' exec='/usr/sbin/ipsecconf -q -a %{config/config_file}' timeout_seconds='60' /> <exec_method type='method' name='refresh' exec='/usr/sbin/ipsecconf -q -a %{config/config_file}' timeout_seconds='60' /> <exec_method type='method' name='stop' exec='/usr/sbin/ipsecconf -F' timeout_seconds='60' /> <property_group name='general' type='framework'> <!-- A user with this authorization can: svcadm restart policy svcadm refresh policy svcadm mark <state> policy svcadm clear policy see auths(1) and user_attr(4)--> <propval name='action_authorization' type='astring' value='solaris.smf.manage.ipsec' /> <!-- A user with this authorization can: svcadm disable policy svcadm enable policy see auths(1) and user_attr(4)--> <propval name='value_authorization' type='astring' value='solaris.smf.manage.ipsec' /> </property_group> <!-- The properties defined below can be changed by a user with 'solaris.smf.value.ipsec' authorization using the svccfg(1M) command. EG: svccfg -s ipsec/policy setprop config/config_file = /new/config_file The new configurations will be read on service refresh: svcadm refresh ipsec/policy Note: svcadm stop/start does not use the new property until after the service has been refreshed. ***Dont edit this manifest to change these properties! --> <property_group name='config' type='application'> <propval name='config_file' type='astring' value='/etc/inet/ipsecinit.conf' /> <propval name='value_authorization' type='astring' value='solaris.smf.value.ipsec' /> </property_group> <property_group name='startd' type='framework'> <propval name='duration' type='astring' value='transient' /> </property_group> <stability value='Unstable' /> <template> <common_name> <loctext xml:lang='C'> IPsec policy initialization </loctext> </common_name> <description> <loctext xml:lang='C'> IPsec policy configuration involves loading rules into the kernel Security Policy Database (SPD) </loctext> </description> <documentation> <manpage title='ipsecconf' section='1M' manpath='/usr/share/man' /> </documentation> </template> </service> </service_bundle>