Trusted Solaris Label Administration

Defining Compartment Words

Compartments are optional words that may be defined to appear in labels. Compartments are called categories in some other trusted systems. Compartments are used to indicate the special handling procedures to be used for the information whose label contains the compartment and the general class of people who may have access to the information.

Compartment words are assigned to non-hierarchical bits. Hierarchies can be established between compartment words based on rules for including bits from one compartment word in the bits defined for another compartment word.

Compartment words are optionally defined in the WORDS subsection for each label type. Each compartment word is assigned to one or more bits.

While all types of labels use the same classifications, the words used for each type of label can be different, even when they are encoded with the same bits and literally refer to the same thing.

The following example shows the SUN FEDERAL compartment word specified with a short name (sname) of SUNFED and compartment bits 40-50.


Example 2-5 Example Compartment Definition for a Sensitivity Label


WORDS:

name= SUN FEDERAL; sname= SUNFED; compartments= 40-50;

Along with its classification field, each label has a 256 bit compartment field. Each bit is assignable in zero or more compartment words, as shown in Table 2-6. Each word can have one or more compartment bits assigned. Out of the 255 available bits, the number of compartment words that can be created is practically limitless. See "Creating Large Numbers of Labels" for examples.

Table 2-6 Bits Available for Classification and Compartment Components

Classification Field 

Compartments Field 

15 bits/32,767 possible values/256 values limit enforced 

256 bits 

The following table can be used for planning compartments and user accreditation range combinations. The ACCREDITATION RANGE for each classification settings should be one of the following.

Table 2-7 Compartments and User Accreditation Range Combinations Planner

Classification 

Compartment Name/ sname/ Bit 

REQUIRED COMBINATIONS/ COMBINATION CONSTRAINTS 

ACCREDITATION RANGE Settings