Types of Label APIs

Sensitivity Label APIs

Sensitivity label APIs can be used to do the following:

• Obtain a process label

• Initialize labels

• Find the greatest lower bound or the least upper bound between two labels

• Compare labels for dominance and equality

• Check and set label types

• Convert labels to a readable format

• Obtain information from the label_encodings file

• Check that a sensitivity label is valid and within the system range

For a description of these APIs, see Chapter 2, Labels and Clearances.

Clearance Label APIs

Users, devices, and network interfaces have label ranges. The upper bound of the range is effectively the clearance. If the upper bound of the range and the lower bound of the range are equal, the range is a single label.

Clearance label APIs can be used to do the following:

• Find the greatest lower bound or the least upper bound between two labels

• Compare labels for dominance and equality

• Convert clearances between the internal format and the hexadecimal format

For a description of these APIs, see Chapter 2, Labels and Clearances.

Label Range APIs

A label range is used to set limits on the following:

• The labels at which hosts can send and receive information

• The labels at which processes acting on behalf of users and roles can work on the system

• The labels at which users can allocate devices

  This use of a label range restricts the labels at which files can be written to storage media on these devices.

Label ranges are assigned administratively. Label ranges can apply to users, roles, hosts, zones, network interfaces, printers, and other objects.

You can use the following methods to obtain information about label ranges:

• getuserrange() obtains the user's label range.

• getdevicerange() obtains the label range of a device.

• tninfo -t template-name shows the label range of a template that is associated with a network interface.

For a description of these APIs, see Chapter 2, Labels and Clearances.