selang Reference Guide › Classes and Properties › Classes in the AC Environment › SECLABEL Class

SECLABEL Class

Each record in the SECLABEL class associates a security level with security categories. A security label overrides the specific security level and security category assignments in the USER record if the SECLABEL class is active. Assigning a security label is equivalent to explicitly assigning the security level and security categories of the security label to the user.

When a USER record includes a security label, the user is granted access to a resource only if the following conditions are met:

• The user security level specified in the security label is equal to or greater than the resource security level.
• All categories specified in the resource record are included in the security category list of the user security label.

Note: On Windows, each security label defined to CA ControlMinder must have a record in the SECLABEL class.

The key of the SECLABEL class record is the name of the security label. This name is used to identify the security label when assigning it to a user or resource.

The following definitions describe the properties contained in this class record. Most properties are modifiable and can be manipulated using selang or the administration interfaces. Non-modifiable properties are marked informational.

CATEGORY

Defines one or more security categories A security category is the name of record in the CATEGORY class. You can assign a security category to accessors and to resources. An accessor can access a resource only if the accessor is assigned to all of the security categories assigned to the resource. assigned to a user or a resource.

COMMENT

Defines additional information that you want to include in the record. CA ControlMinder does not use this information for authorization.

Limit: 255 characters.

CREATE_TIME

(Informational) Displays the date and time when the record was created.

OWNER

Defines the user or group that owns the record.

SECLEVEL

Defines the security level A security level is an integer between 0 and 255 that you can assign to accessors and resources. An accessor cannot access a resource if the accessor has a security level less than the security level assigned to the resource, even if the user is granted access authority in the resource's access control list. of an accessor or resource.

Note: This property corresponds to the level[-] parameter of the ch[x]usr and chres commands.

UPDATE_TIME

(Informational) Displays the date and time when the record was last modified.

UPDATE_WHO

(Informational) Displays the administrator who performed the update.