Session Range
The label range of the user
The label that the user chose at login
The label range of the local system
The session range is the set of labels that is available to a user account during a Trusted Extensions session. The session range is a function of the following constraints:
The session range of a single-label account is the label of the account. Choosing from a range of labels is possible only when a user account is configured to use multiple labels. User with accounts that are configured to use multiple labels can choose different labels during the session. To specify a label, see How to Change the Label of a Workspace in Trusted Extensions User’s Guide .
The single label or session clearance that is chosen at login is in effect throughout the session until logout. During a multilabel session, the user can work at any valid label that is dominated by the session clearance and that dominates the user's minimum label.
Figure 1–7 continues the Figure 1–6 example. As shown in Figure 1–6, the user can specify a session clearance that uses any well-formed label between TS A B and S A B.
Figure 1–7 (a) shows the labels that are available if the user selects a multilabel session with a session clearance of S A B. Because the other intermediate labels between S A B and C are not well-formed, the user can only work at S A B, C A B, or C.
Figure 1–7 (b) shows the labels that are available if the user selects a single-label session with a session label of C A B. Note that C A B is below the minimum clearance. However, C A B is accessible because the user is selecting a session label, not a clearance. Because the session is single-label, the user can work at only one label. In this example, the user specified C A B, although S A B or C could have been chosen instead.
Figure 1-7 Comparison of Session Ranges
