[redhat-lspp] Multilevel Printing

[Linda Knippers]

Matt Anderson wrote:
> The current patches are only able to use the session context as the
> forced label.  It seemed to me that the consensus was that the file
> label was better, which is why I was suggesting it here as the default
> when it was available.  I don't have a strong opinion either way in
> regards to which label is used, so if the session label is better we can
> always use that.
> 
> The main concern that I recall from the earlier discussion was when
> multiple files were specified on a single lpr line there would be a need
> to AND all the labels together in the final output.  From what I
> remember of that discussion the conclusion was that we would just
> disallow that in the security target and not address the issue.

Yeah, I remember the discussion around "least upper bound sensitivity
label label of all the data exported in the print job", and I know
for MCS Dan would like to see the compartment of the file used, but
it seems like Casey made a convincing argument that it should be the
level of the subject.
https://www.redhat.com/mailman/private/redhat-lspp/2005-August/msg00045.html

It would be good to get a ruling.

-- ljk