Re: Not quite MLS.

[Paul McNabb <mcnabb@argus-systems.com>]

[-- Attachment #1: Type: text/plain, Size: 2056 bytes --]

Glenn is right that the Mitre LEF can only work on a per-system rather 
than a per-user basis for disallowing certain classification and 
compartment/category constraints.  The only MLS system that I know of 
that did what you are asking for is the old Addamax B1st system.  That 
MLS system had user clearances as a set of labels and label ranges that 
allowed a specific user clearance to be something like:

{ unc - ts:1,2,3; unc:4 - sec:4 ; con:5 }

which would allow the user to be cleared from unc to ts in categories 1, 
2, and 3 but have only a unc to sec clearance in category 4 and only con 
for category 5.

Strictly speaking, a system can be "fully MLS" regardless of the 
clearance functionality.  Some MLS systems have been built (and bought) 
without any notion of a user clearance at all, particularly some MLS 
systems built to the first generation of TCSEC requirements.

paul

Glenn Faden wrote:
> rob myers wrote:
>>
>> I believe the difference between SELinux with MLS policy and what I am
>> trying to build is that I want higher sensitivity levels to dominate
>> lower sensitivity levels only on a per category basis.
>>
>> For example, it is my understanding that under MLS UserB must have
>> sensitivity level 3 access to category 3 because UserB has access to
>> sensitivity level 3 access to other categories.  Another possibility
>> under MLS would be to remove UserB's access to category 3 for all
>> sensitivities.  Neither of these is what I want the system to do.
>>   
> For MLS systems based on the Mitre/DIA label encodings format it is 
> possible to exclude specific categories on a per sensitivity label 
> basis from the User Accreditation Range. For an example, see:
>
>
> So it is possible to specify a User Accreditation Range conforming to 
> either the UserA or UserB matrix. However, the format only provides 
> for a single User Accreditiation Range that would apply to all users. 
> In MLS systems I'm familiar with, there is no facility to exclude 
> categories from the kernel dominance checks.
>
> --Glenn

[-- Attachment #2: mcnabb.vcf --]
[-- Type: text/x-vcard, Size: 317 bytes --]

begin:vcard
fn:Paul McNabb
n:McNabb;Paul
org:Argus Systems Group
adr:;;1809 Woodfield Drive;Savoy;IL;61874-9505;USA
email;internet:mcnabb@argus-systems.com
title:Chief Security Architect
tel;work:+1 217-355-6308
tel;fax:+1 217-355-1433
tel;cell:+1 217-493-3818
url:http://www.argus-systems.com
version:2.1
end:vcard