The label_encodings file is a standard encodings file of security labels that are used to control the conversion of human-readable labels into an internal format, the conversion from the internal format to a human-readable canonical form, and the construction of banner pages for printed output. On a Solaris Trusted Extensions system, the label_encodings file is protected at the label admin_high. The file should be edited and checked by the security administrator using the Check Label Encodings action in the System_Admin folder in the Application Manager.
In addition to the required sections of the label encodings file that are described in Compartmented Mode Workstation Labeling: Encodings Format, a Solaris Trusted Extensions system accepts optional local extensions. These extensions provide various translation options and an association between character-coded color names and sensitivity labels.
The optional local extensions section starts with the LOCAL DEFINITIONS: keyword and is followed by zero or more of the following unordered statements:
DEFAULT USER SENSITIVITY LABEL= sensitivity label
DEFAULT USER CLEARANCE= clearance
The final part of the LOCAL DEFINITIONS: section defines the character-coded color names to be associated with various words, sensitivity labels, or classifications. This section supports the str_to_label(3TSOL) function. It consists of the COLOR NAMES: keyword and is followed by zero or more color-to-label assignments. Each statement has one of the following two syntaxes:
word= word value; color= color value; label= label value; color= color value;
where color value is a character-coded color name to be associated with the word word value, or with the sensitivity label label value, or with the classification label value.
The character-coded color name color value for a label is determined by the order of entries in the COLOR NAMES: section that make up the label. If a label contains a word word value that is specified in this section, the color value of the label is the one associated with the first word value specified. If no specified word word value is contained in the label, the color value is the one associated with an exact match of a label value. If there is no exact match, the color value is the one associated with the first specified label value whose classification matches the classification of the label.
Example 1 A Sample LOCAL DEFINITIONS: Section
LOCAL DEFINITIONS: DEFAULT USER SENSITIVITY LABEL= C A; DEFAULT USER CLEARANCE LABEL= S ABLE; COLOR NAMES: label= Admin_Low; color= Pale Blue; label= unclassified; color= light grey; word= Project A; color= bright blue; label= c; color= sea foam green; label= secret; color= #ff0000; * Hexadecimal RGB value word= Hotel; color= Lavender; word= KeLO; color= red; label= TS; color= khaki; label= TS Elephant; color= yellow; label= Admin_High; color= shocking pink;
See attributes(5) for descriptions of the following attributes:
The following diagnostics are in addition to those found in Appendix A of Compartmented Mode Workstation Labeling: Encodings Format:
Can't allocate NNN bytes for color names table.
Can't allocate NNN bytes for color table entry.
Can't allocate NNN bytes for color word entry.
Can't allocate NNN bytes for DEFAULT USER CLEARANCE.
Can't allocate NNN bytes for DEFAULT USER SENSITIVITY LABEL.
DEFAULT USER CLEARANCE= XXX is not in canonical form. Is YYY what is intended?
DEFAULT USER SENSITIVITY LABEL= XXX is not in canonical form. Is YYY what is intended?
Duplicate DEFAULT USER CLEARANCE= ignored.
Duplicate DEFAULT USER SENSITIVITY LABEL= ignored.
End of File not found where expected. Found instead: XXX.
End of File or LOCAL DEFINITIONS: not found. Found instead: XXX.
Found color XXX without associated label.
Invalid color label XXX.
Invalid DEFAULT USER CLEARANCE XXX.
Invalid DEFAULT USER SENSITIVITY LABEL XXX.
Label preceding XXX did not have a color specification.
Word XXX not found as a valid Sensitivity Label word.
chk_encodings(1M), label_to_str(3TSOL), str_to_label(3TSOL), attributes(5), labels(5)
Solaris Trusted Extensions Label Administration
Defense Intelligence Agency document DDS-2600-6216-93, Compartmented Mode Workstation Labeling: Encodings Format, September 1993.
Creation of and modification to the label encodings file should only be undertaken with a thorough understanding not only of the concepts in Compartmented Mode Workstation Labeling: Encodings Format, but also of the details of the local labeling requirements.
The following warnings are paraphrased from Compartmented Mode Workstation Labeling: Encodings Format.
Take extreme care when modifying a label encodings file that is already loaded and running on a Solaris Trusted Extensions system. Once the system runs with the label encodings file, many objects are labeled with sensitivity labels that are well formed with respect to the loaded label encodings file. If the label encodings file is subsequently changed, it is possible that the existing labels will no longer be well-formed. Changing the bit patterns associated with words causes existing objects whose labels contain the words to have possibly invalid labels. Raising the minimum classification or lowering the maximum classification that is associated with words will likely cause existing objects whose labels contain the words to no longer be well-formed.
Changes to a current encodings file that has already been used should be limited only to adding new classifications or words, changing the names of existing words, or modifying the local extensions. As described in Compartmented Mode Workstation Labeling: Encodings Format, it is important to reserve extra inverse bits when the label encodings file is first created to allow for later expansion of the label encodings file to incorporate new inverse words. If an inverse word is added that does not use reserved inverse bits, all existing objects on the system will erroneously have labels that include the new inverse word.
The functionality described on this manual page is available only if the system is configured with Trusted Extensions.
This file is part of the Defense Intelligence Agency (DIA) Mandatory Access Control (MAC) policy and might be meaningful only for the DIA MAC policy. This file might not be applicable to other Mandatory policies that might be developed for future releases of Solaris Trusted Extensions software. Parts of it are obsolete and retained for ease of porting. The obsolete parts might be removed in a future Solaris Trusted Extensions release.
Parts of the label_encodings file are considered standard and are controlled by Defense Intelligence Agency document DDS-2600-6216-93, Compartmented Mode Workstation Labeling: Encodings Format, September 1993. Of that standard, the parts that refer to the INFORMATION LABELS: and NAME INFORMATION LABELS: sections are Obsolete. However, the INFORMATION LABELS: section must be present and syntactically correct. It is ignored. The NAME INFORMATION LABELS: section is optional. If present, it is ignored but must be syntactically correct.
Defining the label encodings file is a three-step process. First, the set of human-readable labels to be represented must be identified and understood. The definition of this set includes the list of classifications and other words that are used in the human-readable labels, relations between and among the words, classification restrictions that are associated with use of each word, and intended use of the words in mandatory access control and labeling system output. Next, this definition is associated with an internal format of integers, bit patterns, and logical relationship statements. Finally, a label encodings file is created. The Compartmented Mode Workstation Labeling: Encodings Format document describes the second and third steps, and assumes that the first has already been performed.
The following values in the optional LOCAL DEFINITIONS: section are obsolete. These values might only affect the obsolete bltos(3TSOL) functions, and might be ignored by the label_to_str(3TSOL) replacement function: