HP-UX System Administrator's Guide: Security Management HP-UX 11i v3 (B3921-90020, September 2010)

• The handler processes can communicate with the parent process, and with the
recorder using IPC and signals.
• The network is isolated from the recorder and the parent process.
This compartment configuration provides security for the file system and the recorder.
Both are isolated by their compartments. Though the handler processes can communicate
with the network, the network cannot be accessed by the recorder or the parent process.
6.1.2 Default Compartment Configuration
When you enable compartments, a default compartment named INIT is created. When
you boot up the system, the init process belongs to this compartment. The INIT
compartment is defined to have access to all other compartments and is not defined in
a compartment rules file.
IMPORTANT: If you redefine the INIT compartment by creating explicit rules in a
rules file, all special characteristics of the compartment are lost and cannot be restored
without rebooting the system.
6.2 Planning the Compartment Structure
Plan the compartment structure before you begin creating compartment rules.
To plan the compartment structure, answer the following questions:
• Do you want to isolate different groups of users accessing this system? For example,
is this system used by both the accounting department and the human resources
department, and must these groups of users be kept separate?
• Do you want to isolate one network interface on this system, which communicates
outside the firewall, from the rest of the system, which communicates only inside
the firewall?
• Does the security policy include requirements or problems that can be solved by
using compartments?
• Does the security policy specify or suggest a specific compartment rules
configuration?
When you have answered these questions, use the answers to determine how to assign
parts of the system to specific compartments.
Consider the following recommendations when planning the compartment
configuration:
• Put all compartment configuration files in the /etc/cmpt directory.
You can use the #include directive to create compartment configuration files
anywhere on the system. However, HP recommends that you avoid using this
6.2 Planning the Compartment Structure 111