/usr/sbin/tnctl [-dfv] [-h host [/prefix] [:template]] [-m zone:mlp:shared-mlp][-t template [:key=val [;key=val]]] [-HTz] file]
tnctl provides an interface to manipulate trusted network parameters in the Solaris kernel.
As part of Solaris Trusted Extensions initialization, tnctl is run in the global zone by an smf(5) script during system boot. The tnctl command is not intended to be used during normal system administration. Instead, if a local trusted networking database file is modified without using the Solaris Management Console, the administrator first issues tnchkdb(1M) to check the syntax, and then refreshes the kernel copy with this command:
# svcadm restart svc:/network/tnctl
See WARNINGS about the risks of changing remote host and template information on a running system.
When deleting MLPs, the MLP range must match exactly. MLPs are specified in the form:
Where port can be a number in the range 1 to 65535. or any known service (see services(4)), and protocol can be a number in the range 1 to 255, or any known protocol (see protocols(4)).
# zoneadm -z non-global zone reboot
See attributes(5) for descriptions of the following attributes:
svcs(1), svcadm(1M), tninfo(1M), tnd(1M), tnchkdb(1M), zoneadm(1M), nsswitch.conf(4), protocols(4), services(4), attributes(5), smf(5)
How to Synchronize Kernel Cache With Network Databases in Solaris Trusted Extensions Administrator's Procedures
Changing a template while the network is up can change the security view of an undetermined number of hosts.
The functionality described on this manual page is available only if the system is configured with Trusted Extensions.
The tnctl service is managed by the service management facility, smf(5), under the service identifier:
The service's status can be queried by using svcs(1). Administrative actions on this service, such as refreshing the kernel cache, can be performed using svcadm(1M), as in:
svcadm refresh svc:/network/tnctl