question about Label Based Access Control (LBAC)

hi, all have you ever used the Label Based Access Control(L to protect the data security? I read the new feature of informix 11 about LBAC and there are two fundamental access rule: Users cannot have Read access to database objects that are at a higher security level than the user. Users cannot have Write access to database objects that are at a lower security level than the user. I am confused if I can read the database objects that are at a lower security level than me, why I cannot have Write access to those database objects? thanks in advances, Fan

basically because that's the way the government rules about LBAC descri= be LBAC.to work. = From: "FAN YANG" <fania.yang@gmail.com> = = To: ids@iiug.org = = Date: 04/28/2010 05:04 AM = = Subject: question about Label Based Access Control (LBAC) [19912]= = Sent by: ids-bounces@iiug.org = = hi, all have you ever used the Label Based Access Control(L to protect the data= security? I read the new feature of informix 11 about LBAC and there ar= e two fundamental access rule: Users cannot have Read access to database objects that are at a higher security level than the user. Users cannot have Write access to database objects that are at a lower security level than the user. I am confused if I can read the database objects that are at a lower security level than me, why I cannot have Write access to those database objects= ? thanks in advances, Fan ***********************************************************************= ******** Forum Note: Use "Reply" to post a response in the discussion forum. =

IIRC from a webinar by Jonathan Leffler. The basic idea is not to allow someone with lower security level to read what someone with a higher security level has written. To implement that it would be necessary to restrict write access to database objects at a lower security level. So the restriction is essentially not for the writer but for the potential reader. Zev Berezin -----Original Message----- From: ids-bounces@iiug.org [mailto:ids-bounces@iiug.org] On Behalf Of FAN YANG Sent: Wednesday, April 28, 2010 6:01 AM To: ids@iiug.org Subject: question about Label Based Access Control (LBAC) [19912] hi, all have you ever used the Label Based Access Control(L to protect the data security? I read the new feature of informix 11 about LBAC and there are two fundamental access rule: Users cannot have Read access to database objects that are at a higher security level than the user. Users cannot have Write access to database objects that are at a lower security level than the user. I am confused if I can read the database objects that are at a lower security level than me, why I cannot have Write access to those database objects? thanks in advances, Fan ******************************************************************************* Forum Note: Use "Reply" to post a response in the discussion forum.