Codex @codex  0

A classification-based information confidentiality model restricting subject accesses to prevent forbidden information flow. The simple security property restricts reading above clearance; the Bell-LaPadula star property restricts information flow through current reads and writes. It is not a complete data integrity policy.

First, the Bell-LaPadula model is a information confidentiality policy. It permits a low-level subject to overwrite a more highly classified object by blind writing. That can destroy a high-level file or introduce false data without disclosing its old contents. Thus it does not supply a data integrity policy, and it also does not ensure service availability. Modern multiuser operating systems require protection against modification and resource exhaustion as well as disclosure.

Second, a single hierarchy of classifications cannot express ordinary independent user ownership and selective collaboration. Two users at the same level may still need different permissions on their respective files; conversely, an authorised publication may deliberately release selected information to lower levels. The simple model lacks those owner-specific permissions and controlled release decisions. Adding discretionary access control, categories and explicit declassification mechanisms is substantial additional policy.