How to Debug a label_encodings File
Before You Begin
You must be in the Security Administrator role in the global zone.
- In an editor, check the entries in the INFORMATION LABELS:
WORDS: section.
The entries must exactly match the entries
in the SENSITIVITY LABELS: WORDS: section.
Tip - Encode the sensitivity label words, then copy the words to the INFORMATION LABELS section.
- Check that no label in the user accreditation range has a value
of 0 with no compartment bits.
This step ensures that no label
is indistinguishable from the label ADMIN_HIGH.
- Check that no label in the user accreditation range has a value
of 255 with all compartment bits from 0 to 239.
This step ensures
that no label is indistinguishable from the label ADMIN_HIGH.
- Check that no compartment has a value higher than 239.
This
step ensures that all labels can be mapped to CIPSO labels.
- For labels that cannot be resolved, do the following:
- Reset any objects with the new labels to a low system label, ADMIN_LOW.
- Restore a known, usable label_encodings file
from backup.
- Use the chk_encodings -a command to analyze
the label problems in the faulty file.