Re: MLS concepts, relational question

[Michael C Thompson <thompsmc@us.ibm.com>]

Casey Schaufler wrote:
> --- Michael C Thompson <thompsmc@us.ibm.com> wrote:
> 
>> OK, so assume there are two labels:
>> Label A -- s2:c1 - s15:c0.c1023
> 
> This is an SELinux MLS range label. It
> will not fit in the definitions you have
> below because the definitions you have
> are for discrete value labels. 

>> Label B -- s0:c1,c3,c5,...,c1021,c1023 (odd
>> repeating)
>>
>> What is the relationship between A and B?
>>
>> As my understanding goes, and from a definition I
>> found:
>>
>> A dom B, iff:
>> level(A) >= level(B) and cat(A) <super set of>
>> cat(B)
>>
>> A domby B, iff:
>> level(A) <= level(B) and cat(A) <subset of> cat(B)
>>
>> A eq B, iff:
>> level(A) == level(B) and cat(A) == cat(b)
>>
>> A incomp B, iff:
>> cat(A) not <subset of> cat(B) AND
>> cat(B) not <subset of> cat(A)
> 
> 
> The definition I always used for incomp was
> A incomp B if not (A dom B) and not (B dom A)

That makes sense, the source I was getting my definition from only 
included categories... is the above definition widely used?

>> Assuming all of those are accurate, label A does not
>> DOM, DOMBY, or EQ 
>> B, yet they are not INCOMP...
>>
>> Assuming all of the above is true, what do we call
>> this relationship?
> 
> Illegal, except in Sweden?

So then, using Joe's notation:
A(LOW) incomp B
A(HIGH) dom B
A illegal B ? :)

Guess I need to explain what I'm looking for better next time...
Mike


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.