Dominance and Equivalence

A security label dominates another one if the classification level is the same or higher and the label includes all the categories of the other label.

A security label is equivalent to another if both have the same classification level and the same categories.

Taken together these relations lead to the following access rules:

  1. Read Access is granted if a subjects label dominates an objects label

  2. Write Access is granted if an objects label dominates a subjects label. Yes, this means that one can write but will not be able to read the stuff afterwards!

  3. Read and write access is granted if both security labels involved are equivalent.

  4. In all other cases access is denied. An exception is when a user gets special permission to do a controlled write down - usually by using a specifc program which knows how to prevent information leaks (e.g. by encrypting things)

    After MAC controls DAC rules are still applied and can make a request fail. In different systems the order of MAC and DAC can be reversed.