Almost all system objects are tagged with an effective, active label element, reflecting the classification of the object, or classification of the data contained in the object. In general, object labels are represented in the following form:
Subject labels consist of three label elements: an effective (active) label, as well as a range of available labels. This range is represented using two ordered MLS label elements, and when set on a process, permits the process to change its active label to any label of greater or equal integrity to the low end of the range, and lesser or equal integrity to the high end of the range. In general, subject labels are represented in the following form:
Valid ranged labels must meet the following requirement regarding their elements:
One class of objects with ranges currently exists, the network interface. In the case of the network interface, the effective label element references the default label for packets received over the interface, and the range represents the range of acceptable labels of packets to be transmitted over the interface.
The following sysctl(8) MIBs are available for fine-tuning the enforcement of this MAC policy.