Types of Labels, Their Components and Uses

Trusted Extensions defines two types of labels:

• Sensitivity labels, often referred to as labels

• Clearance labels, referred to as clearances

Sensitivity labels, label ranges, and a label limit or clearance determine who can access which objects on the system. Clearance labels are assigned to users. Sensitivity labels are assigned to processes, including user processes, and to files and directories.

Some objects have a label range. These objects can be accessed at a particular label within the defined label range. A label range from ADMIN_LOW to ADMIN_HIGH allows access at all labels. The security administrator can narrow that label range. Objects with label ranges include the following:

• All hosts and networks with which communications are allowed

• Zones

• User accounts and role accounts

• Allocatable devices, such as tape drives, diskette drives, CD-ROM and DVD devices, and audio devices

• Other devices that are not allocatable, for example, printers, workstations (which are controlled through the label range of the frame buffer), and serial lines when they are used as a login device

The various procedures for setting labels on these objects is described in Trusted Extensions Configuration and Administration. Device Manager GUI in Trusted Extensions Configuration and Administration describes how to set label ranges on devices.

Label Ranges Restrict Access

Label ranges set limits on the following:

• The labels at which hosts can send and receive information.

• The labels at which processes acting on behalf of users and roles can access files and directories in zones.

• The labels at which users can allocate devices, thereby restricting the labels at which files can be written to storage media in these devices.

• The labels at which users can send jobs to printers.

• The labels at which users can log in to workstations. In addition to the user's label range, a label range on the frame buffer can be used to restrict access to a system.

Labels are automatically assigned to email messages. Emails are only visible in an email reader at the label of the message. The label of an email is printed when the email is printed.

Labels Are Used in Access Control Decisions

Labels are used to implement and control access on a system. Labels implement mandatory access control (MAC). With Trusted Extensions, both discretionary access control (DAC) checks and MAC checks must pass before access is allowed to an object. As in Oracle Solaris, DAC is based on permission bits and access control lists (ACLs). For more information, see Chapter 7, Controlling Access to Files (Tasks), in Oracle Solaris 11.1 Administration: Security Services.

MAC compares the label of a process that is running an application with the label or the label range of any object that the process tries to access. The labels implement the set of rules that enforce policy. One rule is read down-read equal. This rule applies when a process tries to access an object. The label of the process has to be greater than or equal to the label of the object, as in:

Label[Process] >= Label[Object]

On a system that is configured with Trusted Extensions, files and directories have slightly different access rules from each other and from process objects, network endpoint objects, device objects, and X window objects. In addition, an object can be accessed in three different ways. A slightly different set of rules applies for each way:

• The name of the file, directory, or device can be viewed.

• The contents or the attributes of the file, directory, or device can be viewed.

• The contents or the attributes of the file, directory, or device can be modified.

The following figure shows a system that uses labels to make an access control decision.

Figure 1-1 Comparing the Label of a Text Editor With the Label Property in the File Browser

In the preceding figure, a user opens a text editor in a workspace with the label ZONE BLUE. The system sets the label of the process that is running the text editor to be equal to the label of the current workspace. Therefore, the text editor displays a label of ZONE BLUE. When the text editor attempts to open a file for editing, the label of the process that is running the text editor is compared to the label of the file. When the two labels are equal, as the File Browser shows, access for writing is allowed.

Label Components

Labels and clearances consist of a single classification and zero or more compartments. The classification portion of a label indicates a relative level of protection. When a label is assigned to an object, the label's classification indicates the sensitivity of the information that is contained in the object. When a clearance is assigned to a user, the classification portion of the clearance label indicates the user's level of trust.

Trusted Extensions supports Common IP Security Option (CIPSO) labels. Each label has a classification field that allows 256 values, and a 256-bit compartments field. You cannot use 0 (zero) for a classification, so you can define a total of 255 classifications. For CIPSO labels, 240 compartment bits are available, for a total of 2²⁴⁰ compartment combinations. The components are illustrated in the following figure. Note that “Class” means “Classification” and “Comp” means “Compartment”.

Figure 1-2 CIPSO Label Definition

The ADMIN_HIGH label and the ADMIN_LOW label are administrative labels. These labels define the upper bound and lower bound of all labels on a system.

Each compartment has one or more compartment bits assigned. The same compartment bit can be assigned to more than one compartment.

The textual format of a classification appears similar to the following:

CLASSIFICATIONS:

name= TOP SECRET; sname= TS; value= 6;initial compartments= 4-5;

The compartment portion of a label is optional. Compartments in a label can be used to represent different kinds of groupings, such as workgroups, departments, divisions, or geographical areas. Compartments can also further identify how information will be handled.

When initial compartments are part of the classification definition, then compartments are part of that label. In the following excerpt, name indicates a compartment that can be used with the TS classification.

WORDS:

name= A;         compartments= 0;
name= B;         compartments= 1;
name= CNTRY1;    sname= c1;     compartments= ~4;
name= CNTRY2;    sname= c2;     compartments= ~5;

Possible labels from the preceding classifications and compartments include TS, TS A, TS B, and TS AB. A file with the TS A label would be available only to users who have the TS classification and the A compartment in their clearances. For an illustration, see Figure 1-3.

Label Dominance

When any type of label has a security level that is equal to or greater than the security level of a second label, the first label is said to dominate the second label. This comparison of security levels is based on classifications and compartments in the labels. The classification of the dominant label must be equal to or higher than the classification of the second label. Additionally, the dominant label must include all the compartments in the second label. Two equal labels are said to dominate each other.

By these criteria, TS A dominates TS, and TS dominates TS. The classification and compartment bits of the Top Secret (TS) label are shown in the following figure.

Figure 1-3 Representation of the TS, TS A, TS B, and TS AB Labels

Another kind of dominance, strict dominance, is sometimes required for access. One label strictly dominates another label when the first label has a security level that is greater than the security level of the other label. Strict dominance is dominance without equality. The classification of the first label is higher than the classification of the second label. The first label contains all the compartments in the second label. Or, if the classifications of both labels are the same, the first label contains all the compartments in the second label, in addition to one or more additional compartments.

Labels that are not in a dominance relationship are said to be disjoint. Disjoint labels are appropriate for separating departments at a company. For example, the label TS HR (Human Resources) would be disjoint from TS Sales.

Accreditation Ranges, Label Ranges, and Valid Labels

Certain combinations of label components can be disqualified by rules in the label_encodings file. Combination rules implicitly define the organization's usable labels. The security administrator is responsible for specifying combination rules.

A valid or well-formed label is a label that satisfies a combination rule. The security administrator defines combination rules by using any of the following means:

• A minimum clearance and a minimum sensitivity label must be specified.

  These system-wide minimum labels establish the lowest clearance and the lowest label that any regular user can have.

• Initial compartments (compartment bits) can be assigned to a classification.

  Initial compartment bits are always associated with the classification in a label. For more details, see Classification Name Syntax.

• A minimum classification, an output minimum classification, and a maximum classification can be associated with any word.

• Hierarchies among words can be defined by the bit patterns that are chosen for each word.

• Required combinations of words can be specified.

• Combination constraints can be specified for words.

Two accreditation ranges are implicitly specified in the label_encodings file:

• System Accreditation Range

• User Accreditation Range

The term accreditation range is also used for the label ranges that are assigned to user and role accounts, printers, hosts, networks, and other objects. Because rules can constrain the set of valid labels, label ranges and accreditation ranges might not include all the potential combinations of label components in a range.

System Accreditation Range

The system accreditation range includes the administrative labels ADMIN_HIGH and ADMIN_LOW. The system accreditation range also includes all the well-formed labels that are constructed from the label components in the label_encodings file.

Administrative role accounts are usually the only accounts that can work at every label within the system accreditation range. An organization can also set up regular user accounts so that users can perform a task that requires an administrative label.

The following figure shows an example of how rules can constrain the labels that are permitted in a system accreditation range.

Figure 1-4 How System Accreditation Range Is Constrained by Rules

Figure 1-4 (a) shows all potential combinations given the classifications, TS (TOP SECRET), S (SECRET), and C (CONFIDENTIAL), and the compartments, A and B.

Figure 1-4 (b) shows a typical rule from the REQUIRED COMBINATIONS subsection of the SENSITIVITY LABELS section and its effects. The lines bracket the labels that are disqualified by the rule. Disqualified labels appear with lines through them. The REQUIRED COMBINATIONS syntax B A means that any label that has B as a compartment must also contain A. The converse is not true. Compartment A is not required to be combined with any other compartments. Because compartment B is only permitted when A is also present, the labels TS B, S B, and C B are not well-formed. Labels that are not well-formed are not in the system accreditation range.

User Accreditation Range

The user accreditation range is the largest set of labels that regular users can access when using Trusted Extensions. The user accreditation range always excludes ADMIN_HIGH and ADMIN_LOW. The user accreditation range is further constrained by any rules that constrain the System Accreditation Range. In addition, the user accreditation range can be constrained by a set of rules in the ACCREDITATION RANGE section of the label_encodings file. Figure 1-5 continues the Figure 1-4 example. Figure 1-5 shows three different types of rules in the ACCREDITATION RANGE section and their effects on the user accreditation range. The lines bracket to the well-formed labels that the particular rule permits.

Figure 1-5 ACCREDITATION RANGE Section of label_encodings File

As shown in the box to the right, the user accreditation range excludes ADMIN_HIGH and ADMIN_LOW. The rule for the TS classification (shown in Figure 1-4) includes all TS combinations except TS B. However, because TS B, and S B and C B, were previously overruled by the REQUIRED COMBINATIONS rule B A (as shown in Figure 1-4), TS A B, TS A, and TS are the only allowed TS combinations. As shown in Figure 1-5, because S A B is defined as the only valid combination for the S classification, S B is excluded again. All C combinations except C A are valid, according the rule for the C classification. However, because C B was overruled earlier, the only permitted combinations for the C classification are C A B and C.

Account Label Range

The account label range is the range of labels that is available to a user account or role account. This range governs the labels at which the user can work when logging in to the system.

The labels that are available in the account label range have the following constraints:

• The user clearance defines the upper bound of the account label range.

  A clearance does not have to be a valid label. Because it must dominate all labels at which the user can work, the clearance must contain all the components of all the labels at which the user can work.

• The minimum label sets the lower bound of the account label range.

  The minimum sensitivity label in the label_encodings file defines an absolute minimum on labels at which any user can work.

Example 1-1 Defining a Valid Clearance That Is Not a Valid Label

Consider a label_encodings file that prohibits the combination of compartments A, B, and C in a label. The valid clearance in this label_encodings file is not a valid label for a user.

• The minimum label would be TS with no compartments.

• TS A B C would be a valid clearance. TS A B C would not be a valid label.

• Valid labels for a user would be TS, TS A, TS B, and TS C.

Account Label Range Examples

The possible clearances and minimum labels that can be assigned to a user are shown in the following example. These labels are based on the accreditation examples from the previous sections.

Figure 1-6 Constraints on Account Label Ranges

In this example, TS A B is the highest label in the system accreditation range. This label contains the only two compartments, A and B, that are permitted to appear together in a label with any classification. TS A B is the clearance assigned to the account.

C is the user's minimum label. The definitions in the account label range constrain the user to work at labels TS A B, TS A, TS, S A B, C A B, or C.

The permitted clearances are TS A B, TS A, TS and S A B. A minimum clearance of S A B is set in the label_encodings file.

Even if TS A B were not a valid label, the security administrator could assign the label as a clearance. The assignment would allow the user to use any valid labels that are dominated by TS and that contain the words A and B. In contrast, if TS were assigned as the account clearance, the user could work at the labels TS and C only. TS without any compartments does not dominate S A B or C A B.

Table 1-1 provides a more complex example. The example illustrates the differences between the possible label combinations, the system accreditation range, the user accreditation range, and some example account label ranges.

Table 1-1 Accreditation Range and Account Label Range Examples

• Regular users without any authorizations can work only with the labels in the User Accreditation Range column.

• The fourth column shows the Account Label Range for a user with a clearance of TS A B and a minimum label of S A B. This range allows the user to work with the labels TS A B, TS A, TS, and S A B.

• The fifth column shows an account with a clearance of TS and a minimum label of C. This account would be allowed to work only with TS, S, and C labels because all the other valid labels that are dominated by TS include the compartments A and B. A and B are not in the clearance.

• The sixth column shows a user who is authorized to work outside the user accreditation range. This user is assigned a single label of ADMIN_LOW.

Session Range

The session range is the set of labels that is available to a user account during a Trusted Extensions session. The session range is a function of the following constraints:

• The label range of the user

• The label that the user chose at login

• The label range of the local system

The session range of a single-label account is the label of the account. Choosing from a range of labels is possible only when a user account is configured to use multiple labels. User with accounts that are configured to use multiple labels can choose different labels during the session. To specify a label, see How to Change the Label of a Workspace in Trusted Extensions User’s Guide.

The single label or session clearance that is chosen at login is in effect throughout the session until logout. During a multilabel session, the user can work at any valid label that is dominated by the session clearance and that dominates the user's minimum label.

Figure 1-7 continues the Figure 1-6 example. As shown in Figure 1-6, the user can specify a session clearance that uses any well-formed label between TS A B and S A B.

Figure 1-7 (a) shows the labels that are available if the user selects a multilabel session with a session clearance of S A B. Because the other intermediate labels between S A B and C are not well-formed, the user can only work at S A B, C A B, or C.

Figure 1-7 (b) shows the labels that are available if the user selects a single-label session with a session label of C A B. Note that C A B is below the minimum clearance. However, C A B is accessible because the user is selecting a session label, not a clearance. Because the session is single-label, the user can work at only one label. In this example, the user specified C A B, although S A B or C could have been chosen instead.

Figure 1-7 Comparison of Session Ranges

Label Availability in Trusted Extensions Sessions

The following figure summarizes the progressive eliminations of available labels. The eliminated labels are shown with a line through them in the range where they are filtered out. The filtered out labels are not shown in subsequent ranges.

Figure 1-8 Cumulative Effect of Constraints on a Session Range

The following set of examples show session label limitations and availability based on users' session choices. These examples continue the example from Figure 1-8.

Example 1-2 Effect of Using Default Label in Multilevel Session

At initial login, the user is assigned the lowest label in the user's account. If the lowest label is CONFIDENTIAL, the user user's first workspace is labeled CONFIDENTIAL. The user can then open workspaces at CONFIDENTIAL A B and SECRET A B, the session clearance.

Example 1-3 Effect on Multilevel Session of User Choosing Higher Label at Initial Login

If the user chooses a higher label at initial login, such as CONFIDENTIAL A B, the user's first workspace is labeled CONFIDENTIAL A B. The user can open a higher-labeled workspace SECRET A B, but cannot open a CONFIDENTIAL workspace during that session.

Example 1-4 Label Availability in Single-Level Session

At initial login, the user must choose a label. The available labels are within the user's label range up to the session clearance. If the clearance is SECRET A B, the labels that are available for the user to choose are CONFIDENTIAL, CONFIDENTIAL A B, SECRET A B. After choosing a label like SECRET A B, the user's first workspace is labeled SECRET A B. Because the session is single-level, the only available workspace label is SECRET A B.

Labeled Workspaces

Labeled workspaces enable users to work at multiple labels during a single session.

If the user selects a range of labels for the session, the first workspace that appears is at the user's minimum label. By default, desktop panels exist for three other workspaces. By entering a workspace and selecting a label, all windows created in that workspace run processes at the selected label.

For details about working in a labeled system, see Trusted Extensions User’s Guide.