Previous Topic: Establishing the MLS EnvironmentNext Topic: Auditing MLS

Implementing and Administering an Multilevel Secure System › Monitoring MLS

Monitoring MLS

The following TSS commands can be used to display MLS-related information online in CA Top Secret systems:

WHOAMI Command

The WHOAMI command is used to display your current active security label in an MLS environment. This security label is the one with which you entered the system and endures for the duration of your session. It cannot be used to display any user's security label other than your own.

MLWRITE Command

When MLS is active on a system, and write-down is globally protected, the MLWRITE subcommand can be issued by an authorized user not only to set or reset the user's controlled write-down privilege, but also to display it. However, it cannot be used to display any other user's controlled write-down privilege.

To display your controlled write-down privilege, enter:

TSS MLWRITE
TSS1409I WRITE-DOWN FOR USER USERA IS: DISABLED

F TSS,STATUS(MLS)

The settings of the MLS control options can be displayed using the TSS modify command from an operator console or from a TSO session.

LIST MLS Command

The LIST MLS subcommand displays the MLS security classifications defined on the system.

LIST(MLS) SECLEVEL(level|ALL)
CATEGORY(categoryname|ALL)
SECLABEL(labelname|ALL)  DATA(ALPHA|hi-lo|lo-hi|active)
RESOURCE(ALL) | resclass(entity) | resclass(ALL)
SECLEVEL

Displays the defined security levels in numerical order. To display security levels, you must have the MLSADMIN authority in your acid.

CATEGORY

Displays the defined categories in alphabetical order. To display categories, you must have the MLSADMIN privilege in your acid.

SECLABEL

Displays the defined security labels in alphabetical order by default. Security labels may also be displayed in high-to low (or low-to-high) order by security level. The DATA(ACTIVE) option will display only the security labels that are active on the system from which the command was issued. To display security labels, you must have the MLSADMIN privilege in your acid.