Oracle Solaris Trusted Extensions Administrator's Procedures

Dominance Relationships Between Labels

One entity's label is said to dominate another label if the following two conditions are met:

The classification component of the first entity's label is equal to or higher than the second entity's classification. The security administrator assigns numbers to classifications in the label_encodings file. The software compares these numbers to determine dominance.
The set of compartments in the first entity includes all of the second entity's compartments.

Two labels are said to be equal if they have the same classification and the same set of compartments. If the labels are equal, they dominate each other and access is permitted.

If one label has a higher classification or if it has the same classification and its compartments are a superset of the second label's compartments, or both, the first label is said to strictly dominate the second label.

Two labels are said to be disjoint or noncomparable if neither label dominates the other label.

The following table presents examples of label comparisons for dominance. In the example, NEED_TO_KNOW is a higher classification than INTERNAL. There are three compartments: Eng, Mkt, and Fin.

Table 1–1 Examples of Label Relationships


Label 1	Relationship	Label 2
`NEED_TO_KNOW Eng Mkt`	(strictly) dominates	`INTERNAL Eng Mkt`
`NEED_TO_KNOW Eng Mkt`	(strictly) dominates	`NEED_TO_KNOW Eng`
`NEED_TO_KNOW Eng Mkt`	(strictly) dominates	`INTERNAL Eng`
`NEED_TO_KNOW Eng Mkt`	dominates (equals)	`NEED_TO_KNOW Eng Mkt`
`NEED_TO_KNOW Eng Mkt`	is disjoint with	`NEED_TO_KNOW Eng Fin`
`NEED_TO_KNOW Eng Mkt`	is disjoint with	`NEED_TO_KNOW Fin`
`NEED_TO_KNOW Eng Mkt`	is disjoint with	`INTERNAL Eng Mkt Fin`

Administrative Labels

Trusted Extensions provides two special administrative labels that are used as labels or clearances: ADMIN_HIGH and ADMIN_LOW. These labels are used to protect system resources and are intended for administrators rather than regular users.

ADMIN_HIGH is the highest label. ADMIN_HIGH dominates all other labels in the system and is used to protect system data, such as administration databases or audit trails, from being read. You must be in the global zone to read data that is labeled ADMIN_HIGH.

ADMIN_LOW is the lowest label. ADMIN_LOW is dominated by all other labels in a system, including labels for regular users. Mandatory access control does not permit users to write data to files with labels lower than the user's label. Thus, a file at the label ADMIN_LOW can be read by regular users, but cannot be modified. ADMIN_LOW is typically used to protect public executables that are shared, such as files in /usr/bin.