How to Downgrade Data in a Multilevel Dataset

Language:

To downgrade date, you first move the file to its target directory, then relabel it. For an explanation, see Multilevel Datasets for Relabeling Files in Trusted Extensions Configuration and Administration.

Before You Begin

You must be authorized to downgrade files. The administrator has mounted a multilevel dataset in at least one of the labeled zones, and has used a standard name, such as /multi, for all mounts of the dataset that you can access, and has permitted relabeling in that zone.

Therefore, your administrator must have completed the following tasks:

How to Create and Share a Multilevel Dataset in Trusted Extensions Configuration and Administration
How to Enable Files to Be Relabeled From a Labeled Zone in Trusted Extensions Configuration and Administration
How to Enable a User to Change the Security Level of Data in Trusted Extensions Configuration and Administration

You must be logged in to a multilevel session.

Create a workspace at the label of the source file.
For example, create an internal workspace.

For details, see How to Add a Workspace at Your Minimum Label.
Open a terminal window and open a profile shell.
```
% pfbash
$
```
(Optional)Confirm the label of the source file and its containing directory.
For details, see How to Determine the Label of a File.

Note - If the source file is at the same label as its parent directory, it cannot be downgraded in place. You must move the file. Moving the file is a privileged operation.

Move the source file to a directory at the target label.

$ mv /multi/internal-directory/file /multi/public-directory

Change the label to the label of the target directory.

$ cd /multi/public-directory
$ setlabel public file

(Optional)Verify that the file has been relabeled.
```
$ getlabel /multi/public-directory/file
/multi/public-directory/file: PUBLIC
```
You can edit the file at the PUBLIC label.

Example 6 Changing the Label of a Directory

In this example, an authorized user relabels a directory.

First, the user moves or removes all files from the directory.

$ getlabel /multi/conf
/multi/conf: CONFIDENTIAL : NEED TO KNOW
$ mv /multi/conf/* /multi/confNTK/temp

Then, the user sets the label of the directory and verifies the new label.

$ setlabel "Confidential : Internal Use Only" /multi/conf
getlabel /multi/conf
/multi/conf: "CONFIDENTIAL : INTERNAL USE ONLY"