| The NCSC used to use the terms "Sensitivity Levels" and "Sensitivity
Labels" to mean two different things. Our documentation may still make
that distinction. The term Level referred only to the hierarchical
classification, and the term Label referred to the thing that is the
combination of classification and zero or more non-hierarchical
categories. (Now, the Label is just the Lewis Carroll Name of a Level.
:-).
Classifications are defined in the first section of the Encodings file.
Categories are known in the Encodings file syntax as "compartments"
(although to be strictly in line with the newer NCSC terminology, it's
my understanding that a compartment is really a [collection of things
that are protected by the same] sensitivity label).
The categories you can use in a sensitivity label are defined in the
WORDS subsection of the SENSITIVITY LABEL section of the Encodings
file.
To see what labels (combinations of classification+categories) are
valid at a glance, you can also play with the dxchlevel tool,
accessible from the Trusted Path menu as "Get/Set File Label", and it's
"Change File Label: Change" menu. Clicking OK with an attempts to make
an illegal SL will get the "not in accreditation range" pop-up.
The default Encodings file does not have many (or any? I cannot
remember) implicit combination restrictions (e.g., the minimum
classification for category A is CONFIDENTIAL) or explicit combination
contraints (defined in the REQUIRED COMBINATIONS or COMBINATION
CONTRAINTS subsections), so the list of valid labels is extensive. For
a more interesting Encodings file, try using the Encodings.MITRE
version. To make it more useful, as well as more interesting:
1. Change the minimum clearance, minimum sensitivity label, and
minimum protect as classification to U.
2. Add this line:
name= SYSHI; minclass= TS; compartments= 0-6;
to the WORDS section of the SENSITIVITY LABELS and the CLEARANCES
sections, before the first category (A) definition and after the
prefix definitions.
3. In the INFORMATION LABELS WORDS section, move the line:
name= SYSHI; minclass= TS; compartments= 0-6; markings= 0-16;
so that it is between the first category name ("CC") and the
suffix "eyes only".
When you are shifting from one flavor of these shipped Encodings files
to another flavor which uses all the same definitions, you only need to
copy your choice in place, e.g.,
cd /etc/policy/macilb
cp Encodings.MITRE.mod Encodings
And restart dxchevel to see the effects of the new restrictions.
|