Labels, label ranges, and a label limit determine who can access information on a system that is configured with Trusted Extensions.
The label APIs are used to access, convert, and perform comparisons for labels, label ranges and limits, and the relationship between labels. A label can dominate another label, or a label can be disjoint from another label.
The label_encodings file defines the sensitivity labels, clearance labels, label ranges, and label relationships that pertain to your Trusted Extensions environment. This file also controls the appearance of labels. The security administrator is responsible for creating and maintaining the label_encodings file. See the label_encodings(4) man page.
The label of a process is determined by the zone in which the process executes.
All objects are associated with a label or sometimes with a label range. An object can be accessed at a particular label within the defined label range. The objects that are associated with a label range include the following:
All users and all roles
All hosts with which communications are permitted
Zone interfaces and network interfaces
Allocatable devices, such as tape drives, CD-ROM devices, and audio devices
Other devices that are not allocatable, such as printers and workstations
Workstation access is controlled by the label range that is set for the frame buffer or video display device. The security administrator sets this range by using the Device Manager GUI. By default, devices have a range from ADMIN_LOW to ADMIN_HIGH.
For more information about labels, see Label Types.
MAC compares the label of the process that is running an application with the label or the label range of any object that the process tries to access. MAC permits a process to read down to a lower label and permits a process to write to an equal label.
Label[Process] >= Label[Object]
A process bound to a multilevel port (MLP) can listen for requests at multiple labels and send replies to the originator of the request. In Trusted Extensions, such replies are write-equal.
Label[Process] = Label[Object]
Sensitivity label APIs can be used to do the following:
Obtain a process label
Initialize labels
Find the greatest lower bound or the least upper bound between two labels
Compare labels for dominance and equality
Check and set label types
Convert labels to a readable format
Obtain information from the label_encodings file
Check that a sensitivity label is valid and within the system range
For a description of these APIs, see Chapter 2, Labels and Clearances.
Users, devices, and network interfaces have label ranges. The upper bound of the range is effectively the clearance. If the upper bound of the range and the lower bound of the range are equal, the range is a single label.
Clearance label APIs can be used to do the following:
Find the greatest lower bound or the least upper bound between two labels
Compare labels for dominance and equality
Convert clearances between the internal format and the hexadecimal format
For a description of these APIs, see Chapter 2, Labels and Clearances.
A label range is used to set limits on the following:
The labels at which hosts can send and receive information
The labels at which processes acting on behalf of users and roles can work on the system
The labels at which users can allocate devices
This use of a label range restricts the labels at which files can be written to storage media on these devices.
Label ranges are assigned administratively. Label ranges can apply to users, roles, hosts, zones, network interfaces, printers, and other objects.
You can use the following methods to obtain information about label ranges:
getuserrange() obtains the user's label range.
getdevicerange() obtains the label range of a device.
tncfg -t template-name info shows the label range of a template that is associated with a network interface.
For a description of these APIs, see Chapter 2, Labels and Clearances.