DEVICE_CLEAN(7) Standards, Environments, and Macros DEVICE_CLEAN(7)

device_clean - device clean programs

Each allocatable device has a device clean program associated with it. Device clean programs are invoked by deallocate(1) to clean device states, registers, and any residual information in the device before the device is allocated to a user. Such cleaning is required by the object reuse policy.

Use list_devices(1) to obtain the names and types of allocatable devices as well as the cleaning program and the authorizations that are associated with each device.

On a system configured with Trusted Extensions, device clean programs are also invoked by allocate(1), in which case the program can optionally mount appropriate media for the caller.

The following device clean programs reside in /etc/security/lib.


audio devices


floppy devices


tape devices


CD-ROM devices

On a system configured with Trusted Extensions, the following additional cleaning programs and wrappers are available.


floppy, CD-ROM, and other removable media devices. This program mounts the device during the execution of allocate, if required.


wrapper to make audio_clean work with CDE


wrapper to make other cleaning programs work with CDE


CDE dialog boxes for cleaning programs

Administrators can create device clean programs for their sites. These programs must adhere to the syntax described below.

/etc/security/lib/device-clean-program [−i | −f | −s | −I] \
−m mode −u user-name −z zone-name −p zone-path device-name



The name of the device that is to be cleaned. Use list_devices to obtain the list of allocatable devices.


Invoke boot-time initialization.


Force cleanup by the administrator.


Invoke standard cleanup by the user.


Same as -i, with no error or warning.

The following options are supported only when the system is configured with Trusted Extensions.

-m mode

Specify the mode in which the clean program is invoked. Valid values are allo- cate and deallocate. The default mode is allocate.

-u user-name

Specify the name of user who executes the device clean program. The default user is the caller.

-z zone-name

Specify the name of the zone in which the device is to be allocated or deallocated. The default zone is the global zone.

-p zone-path

Establish the root path of the zone that is specified by zone-name. Default is "/".

The following exit values are returned:


Successful completion.


An error. Caller can place device in error state.


A system error. Caller can place device in error state.

On a system configured with Trusted Extensions, the following additional exit values are returned:


Mounting of device failed. Caller shall not place device in error state.


Mounting of device succeeded.


device clean programs

See attributes(7) for descriptions of the following attributes:

Interface Stability See below.

The Invocation is Uncommitted. The Output is Not-an-interface.

allocate(1), deallocate(1), list_devices(1), attributes(7)

System Administration Guide: Security Services

June 14, 2007 OmniOS