Contained Within
Find More Documentation
Featured Support Resources
|  Descargar este libro en PDF (6561 KB)
elfsign(1)
Name
| Synopsis
| Description
| Options
| Operands
| Examples
| Exit Status
| Files
| Attributes
| See Also
Name
Synopsis
/usr/bin/elfsign sign [-a] [-v] -k private_key -c certificate_file
-e elf_object [-F format] [file]...
/usr/bin/elfsign sign [-a] [-v] -c certificate_file
-e elf_object -T token_label [-P pin_file] [-F format] [file]...
/usr/bin/elfsign verify [-c certificate_file]
[-v] -e elf_object [file]...
/usr/bin/elfsign request -r certificate_request_file
{-k private_key | -T token_label}
/usr/bin/elfsign list -f field -c certificate_file
/usr/bin/elfsign list -f field -e elf_object
Description
-
list
-
Lists on standard output information from a single certificate file or signed elf object. The selected field appears on a single line. If the field specified does not apply to the named file, the command terminates with no standard output. This output of this subcommand is intended
for use in scripts and by other commands.
-
request
-
Generates a private key and a PKCS#10 certificate request. The PKCS#10 certificate request for use with the Solaris Cryptographic Framework. If the private key is to be created in a token device, elfsign prompts for the PIN required to update the token device. The PKCS#10 certificate
request should be sent to the email address solaris-crypto-req@sun.com to obtain a Certificate.
Users of elfsign must first generate a certificate request and obtain a certificate before signing binaries for use with the Solaris Cryptographic Framework.
-
sign
-
Signs the elf object, using the given private key and certificate file.
-
verify
-
Verifies an existing signed object. Uses the certificate given or searches for an appropriate certificate in /etc/crypto/certs if -c is not given.
Options
Operands
Examples
Example 1 Signing an ELF Object Using a Key/Certificate in a File
example$ elfsign sign -k myprivatekey -c mycert -e lib/libmylib.so.1
|
Example 2 Verifying an elf Object's Signature
example$ elfsign verify -c mycert -e lib/libmylib.so.1
elfsign: verification of lib/libmylib.so.1 passed
|
Example 3 Generating a Certificate Request
example$ elfsign request -k mykey -r req.pkcs10
Enter Company Name / Stock Symbol or some other globally
unique identifier.
This will be the prefix of the Certificate DN: SUNW
The government of the United States of America restricts the export of
“open cryptographic interfaces”, also known as “crypto-with-a-hole”.
Due to this restriction, all providers for the Solaris cryptographic
framework must be signed, regardless of the country of origin.
The terms "retail" and "non-retail" refer to export classifications for
products manufactured in the USA. These terms define the portion of the
world where the product may be shipped.) Roughly speaking, "retail" is
worldwide (minus certain excluded nations) and "non-retail" is domestic
only (plus some highly favored nations).
If your provider is subject to USA export control, then you
must obtain an export approval (classification)
from the government of the USA before exporting your provider.
It is critical that you specify the obtained (or expected, when
used during development) classification to the following questions
so that your provider will be appropriately signed.
Do you have retail export approval for use without restrictions
based on the caller (for example, IPsec)? [Yes/No] No
If you have non-retail export approval for unrestricted use of your
provider by callers, are you also planning to receive retail
approval by restricting which export sensitive callers
(for example, IPsec) may use your provider? [Yes/No] No
[...]
|
Example 4 Determining Information About an Object
example$ elfsign list -f format -e lib/libmylib.so.1
rsa_md5_sha1
example$ elfsign list -f signer -e lib/libmylib.so.1
CN=VENDOR, OU=Software Development, O=Vendor Inc.
|
Exit Status
Files
-
/etc/crypto/certs
-
Directory searched for the verify subcommand if the -c flag is not used
Attributes
See attributes(5) for descriptions of the following attributes:
|
ATTRIBUTE TYPE
|
ATTRIBUTE VALUE
|
|
Availability
|
SUNWtoo
|
|
Interface Stability
|
See below.
|
The elfsign command and subcommands are Committed. While applications should not depend on the output format of elfsign, the output format of the list subcommand is Committed.
See Also
SunOS 5.10 Last Revised 7 Jul 2008
Name
| Synopsis
| Description
| Options
| Operands
| Examples
| Exit Status
| Files
| Attributes
| See Also
|
