Multi-Level Security Labeling Statements ======================================== Because there are many options for MLS labeling, the examples show a limited selection of statements, however there is a simple policy that will build shown in the [`levelrange`](cil_mls_labeling_statements.md#levelrange) section. sensitivity ----------- Declare a sensitivity identifier in the current namespace. Multiple [`sensitivity`](cil_mls_labeling_statements.md#sensitivity) statements in the policy will form an ordered list. **Statement definition:** ```secil (sensitivity sensitivity_id) ``` **Where:**
sensitivity
The sensitivity keyword.
sensitivity_id
The sensitivity identifier.
sensitivityalias
The sensitivityalias keyword.
sensitivityalias_id
The sensitivityalias identifier.
sensitivityaliasactual
The sensitivityaliasactual keyword.
A single previously declared sensitivityalias identifier.
A single previously declared sensitivity identifier.
sensitivityorder
The sensitivityorder keyword.
One or more previously declared sensitivity or sensitivityalias identifiers..
category
The category keyword.
category_id
The category identifier.
categoryalias
The categoryalias keyword.
categoryalias_id
The categoryalias identifier.
categoryaliasactual
The categoryaliasactual keyword.
A single previously declared categoryalias identifier.
A single previously declared category identifier.
categoryorder
The categoryorder keyword.
One or more previously declared category or categoryalias identifiers.
categoryset
The categoryset keyword.
categoryset_id
The categoryset identifier.
Zero or more previously declared category or categoryalias identifiers.
Note that there must be at least one category_id identifier or expr parameter declared.
expr
Zero or more expr's, the valid operators and syntax are:
(and (category_id ...) (category_id ...))
(or (category_id ...) (category_id ...))
(xor (category_id ...) (category_id ...))
(not (category_id ...))
(range category_id category_id)
(all)
sensitivitycategory
The sensitivitycategory keyword.
A single previously declared sensitivity or sensitivityalias identifier.
A single previously declared categoryset (named or anonymous), or a list of category and/or categoryalias identifiers. The examples show each variation.
level
The level keyword.
level_id
The level identifier.
levelrange
The levelrange keyword.
levelrange_id
The levelrange identifier.
low_level_id
The current level specified by a previously declared level identifier. This may be formed by named or anonymous components as discussed in the level section and shown in the examples.
high_level_id
The clearance or high level specified by a previously declared level identifier. This may be formed by named or anonymous components as discussed in the level section and shown in the examples.
rangetransition
The rangetransition keyword.
source_type_id
A single previously declared type, typealias or typeattribute identifier.
type
typealias
typeattribute
target_type_id
class_id
A single previously declared class or classmap identifier.
class
classmap
new_range_id
The new MLS range for the object class that is a previously declared levelrange identifier. This entry may also be defined as an anonymous or named level, sensitivity, sensitivityalias, category, categoryalias or categoryset identifier.