One entity's label is said to dominate another's if the following two conditions are met:
The classification component of the first entity's label is equal to or higher than the second entity's classification. (The security administrator assigns numbers to classifications in thelabel_encodings(4) file. These numbers are compared when determining dominance.)
The set of compartments in the first entity includes all of the second entity's compartments.
Two labels are said to be equal if they have the same classification and the same set of compartments. If they are equal, they dominate each other and access is permitted.
If one label has a higher classification or if it has the same classification and its compartments are a superset of the second label's compartments or both, the first label is said to strictly dominate the second label.
Two labels are said to be disjoint or noncomparable if neither label dominates the other.
The following table presents examples of label comparisons for dominance. In the example, NEED_TO_KNOW is a higher classification than INTERNAL. There are three compartments: Eng, Mkt, and Fin.
Table 1-5 Examples of Label Relationships
Label 1 |
Relationship |
Label 2 |
---|---|---|
NEED_TO_KNOW Eng Mkt |
(strictly) dominates |
INTERNAL Eng Mkt |
NEED_TO_KNOW Eng Mkt |
(strictly) dominates |
NEED_TO_KNOW Eng |
NEED_TO_KNOW Eng Mkt |
(strictly) dominates |
INTERNAL Eng |
NEED_TO_KNOW Eng Mkt |
dominates (equals) |
NEED_TO_KNOW Eng Mkt |
NEED_TO_KNOW Eng Mk |
is disjoint with |
NEED_TO_KNOW Eng Fin |
NEED_TO_KNOW Eng Mkt |
is disjoint with |
NEED_TO_KNOW Fin |
NEED_TO_KNOW Eng Mkt |
is disjoint with |
INTERNAL Eng Mkt Fin |
The Trusted Solaris environment provides two special administrative labels that are used as labels or clearances: ADMIN_HIGH
and ADMIN_LOW
. (You can rename these two labels in the label_encodings(4) file if you choose.) These labels are used to protect system resources and are intended for administrators rather than normal
users.
ADMIN_HIGH
is the highest label. ADMIN_HIGH
dominates all other labels in the system and is used to protect system data, such as administration databases or audit trails, from being read. You need to work at the ADMIN_HIGH
label (typically in a role) or have the privilege to read up from your current
label to read data labeled ADMIN_HIGH
.
ADMIN_LOW
is the lowest label. ADMIN_LOW
is dominated by all other labels in a system. Mandatory access control does not permit users to write data to files with labels lower than the subject's label. Thus, applying ADMIN_LOW
,
the lowest label, to a file ensures that normal users cannot write to it although they can read it. ADMIN_LOW
is typically used to protect public executables and configuration files to prevent them from being modified, since only a user working at ADMIN_LOW
or with the privilege to write down would be
able to write to these files. Typically, only an administrator would work at ADMIN_LOW
.