A multilevel file system for high assurance

The designs of applications for multilevel systems cannot merely duplicate those of the untrusted world When applications are built on a high assurance base they will be constrained by the underlying policy en forcement mechanism Consideration must be given to the creation and management of multilevel data struc tures by untrusted subjects Applications should be de signed to rely upon the TCB s security policy enforce ment services rather than build new access control ser vices beyond the TCB perimeter The results of an analysis of the design of a gen eral purpose le system developed to execute as an un trusted application on a high assurance TCB are pre sented The design illustrates a number of solutions to problems resulting from a high assurance environ ment