Trusted Solaris Label Administration

Hierarchical Words

Hierarchical compartments can be used when you want some way to differentiate between documents that have to be accessible to everyone in a larger group and documents that can be accessed only by subgroups. Hierachical compartments can be created by:

Using Bit Combinations to Establish Hierarchies

By defining a word that uses one bit and a second word that uses that same bit along with a second bit, you define a hierarchical relationship between the two words. The compartment word that is more general must be defined below the word that is more specific.

For example, by defining a word that uses bit number 1 and another word that uses bits number 1 and 2, you give the two words a hierarchical relationship. The following screen example shows definitions for a Sales compartment with two subcompartments, Direct Sales, and Indirect Sales. It supposes that a single classification named WebCo is defined.

Figure 2-1 Bit Combinations Defining Hierarchical Relationships


name= Direct_Sales;   compartments= 1, 2
name= Indirect_Sales;   compartments= 1, 3
name= Sales;   compartments= 1

The definition in the screen example allows the WebCo company to differentiate between documents that can be accessed by anyone in the entire sales force, documents that can be accessed only by members of the indirect sales force, and documents that can be accessed only by members of the direct sales force.

Using REQUIRED COMBINATIONS to Establish Hierarchies

If two words are specified together in the REQUIRED COMBINATIONS section, the second label is added to the label whenever the first word is used. The following example shows a definition of the Direct Sales, Indirect_Sales, and Sales that serves essentially the same effect as the example in Figure 2-2. The difference is that the Direct_Sales word will always have the Sales word with it

Figure 2-2 REQUIRED COMBINATIONS Used to Establish Hierarchies


name= Direct_Sales;   compartments= 2
name= Indirect_Sales;   compartments= 3
name= Sales;   compartments= 1

REQUIRED COMBINATIONS:

Direct_Sales            Sales
Indirect_Sales          Sales