Users Cannot Read Email Below Minimum Label

The sendmail.cf file has been extended with Trusted Solaris options to enable the security administrator to customize labeled mail delivery. By default, ADMIN_LOW-labeled mail is upgraded to the recipient's minimum label. Other mail that is labeled below the recipient's minimum label is returned. ADMIN_LOW mail is treated differently from other mail because ADMIN_LOW mail is always sent by a system process to an account (usually an administrative role account) that should see the mail.

The default behavior is shown in the commented-out lines in the sendmail.cf file.

#O LabelAdminLow=upgrade
#O LabelTooLow=return

The Security Administrator role may change the values for the Trusted Solaris-specific options in the sendmail(1M) configuration file sendmail.cf to be consistent with the site's security policy. A user who is cleared to a particular label, such as CONFIDENTIAL or INTERNAL USE ONLY, should probably not be able to send mail to a user whose minimum label dominates the first user's label, such as SECRET or NEED TO KNOW.