SETLAB(1)

NAME
setlab, downgrade, setpriv - set security label on files

SYNOPSIS
setlab [ option ... ] label file ... ]

priv downgrade [ -v ] delta file ...

priv setpriv cap lic file ...

DESCRIPTION
Setlab sets the security label on the named files, or on the standard input if no files are named. The label is a single argument in the style accepted by atolab; see labtoa(3). The options are

-a  Add label to the current file label (new=old|label).

-s  Subtract label from the current file label (new=old&~label).

-p  Set privileges (capabilities and licenses) only.

-v  Print a blow-by-blow account on standard error file.

The process must be able to open the file, either for reading or writing. One or more licenses (see getplab(2)) are needed in some instances:

T_EXTERN
    to downgrade (new label does not dominate old)

T_SETPRIV
    if either the old or the new label has nonzero privilege bits

T_NOCHK
    if the old label has flag L_NO (also need T_EXTERN to change away from L_NO).

Downgrade uses setlab to clear the label bits designated by delta. It is a conventional request defined in the privilege file, privs(5), which checks that the user has authority over the specified label bits and supplies the necessary privilege to setlab.

Setpriv is a conventional interface to setlab for changing file capabilities and licenses.

EXAMPLES

setlab ffff... file
    Give the file a top label.

setlab -a F file
    Freeze a file label to keep writes from raising the lattice value.

lmask x setlab -s 03 file
    Downgrade a security label using a privileged nosh(8) session. The downgrade priv request is preferred.

priv downgrade 03 file
    Same, using obtaining the necessary authorization and privilege from priv(1).

priv setpriv - n file
    Give the file a license, but no capabilities. This is a conventional trick to make the file immutable until its privileges are turned off again. The lattice value of the label is bottom (all zero).

DIAGNOSTICS
`Locking file for vetting'. As a matter of policy, setlab refuses to assign arbitrary privileges to a previously unprivileged (`untrusted') file. Instead it marks the file immutable as in the last example. The file may then be examined at leisure to assess whether its contents are indeed trustable before privileges are finally assigned.

SEE ALSO
getflab(2), getlab(1), priv(1)

BUGS
The strings -a and -p happen to be legitimate, if unusual, labels. They will always be understood as option flags.