Special Rights

Some special rights to types have been defined:

ADMIN:

Administrate this type, i.e., change type name or remove type.

ASSIGN:

Assign this type to objects. Additionally, MODIFY_ATTRIBUTE to the previous type of the object is needed.

ACCESS_CONTROL:

Change type compatibility settings for this type and all requests, which are no special rights.

SUPERVISOR:

Change type compatibility settings for this type for all special rights. If no role has SUPERVISOR right or Admin Type set to Role Admin, the special right settings can no longer be changed.

• specialrights := {ADMIN, ASSIGN, ACCESS_CONTROL, SUPERVISOR}
• administratetype$_{tn}$(p:process, t:type) := process p administrates type t at time n
• assigntype$_{tn}$(p:process, t:type, o:object) := process p assigns the type t to object o at time n
• changetypecomp$_{tn}$(p:process, r:role, t:type, a:access_type) := process p adds or removes access type a to or from the type compatibility set of role r to type t at time n

$${\mathrm{administratetype}_{tn}(\mathrm{p,t}) \Rightarrow}$$

$$\mathrm{compatible}_{tn}(\mathrm{currentrole}_{tn}(\mathrm{p}),\mathrm{t},\mathrm{ADMIN})$$ (30)

$${\mathrm{assigntype}_{tn}(\mathrm{p,t,o}) \Rightarrow}$$

$$\mathrm{compatible}_{tn}(\mathrm{currentrole}_{tn}(\mathrm{p}),\mathrm{t},\mathrm{ASSIGN})$$

$$\wedge \mathrm{compatible}_{tn}(\mathrm{currentrole}_{tn}(\mathrm{p}),\mathrm{efftype}_{tn}(\mathrm{o}),\mathrm{MODIFY\_ATTRIBUTE})$$ (31)

$${\mathrm{changetypecomp}_{tn}(\mathrm{p,r,t,a}) \wedge\ \mathrm{a} \not\in \mathrm{specialrights} \Rightarrow}$$

$$\mathrm{compatible}_{tn}(\mathrm{currentrole}_{tn}(\mathrm{p}),\mathrm{t},\mathrm{ACCESS\_CONTROL})$$

$$\wedge \mathrm{r} \in\ \mathrm{adminroles(currentrole}_{tn}(\mathrm{p}))$$ (32)

$${\mathrm{changetypecomp}_{tn}(\mathrm{p,r,t,a}) \wedge\ \mathrm{a} \in \mathrm{specialrights} \Rightarrow}$$

$$\mathrm{compatible}_{tn}(\mathrm{currentrole}_{tn}(\mathrm{p}),\mathrm{t},\mathrm{SUPERVISOR})$$

$$\wedge \mathrm{r} \in\ \mathrm{adminroles(currentrole}_{tn}(\mathrm{p}))$$ (33)