DB2 UDB for z/OS Version 8 Performance Topics - IBM Redbooks

up to eight uppercase alphanumeric or national characters and each SECLABEL profile
specifies the particular combination of:
► A SECLEVEL member
► Zero or more members of the CATEGORY profile that apply to the security label
For example:
RDEFINE SECLABEL L1C12 SECLEVEL(L1) ADDCATEGORY(C1 C2) UACC(NONE)
In addition, RACF has a number of built-in security labels.
► SYSHIGH: Is equivalent to the highest security level defined and covers all categories
defined.
► SYSLOW: Is equivalent to the lowest security level defined and has no categories signed.
It is dominated by all other security labels.
► SYSNONE: Is treated as equivalent to any security label to which it is compared.
SYSNONE, like SYSLOW, should be used for data that has no classified data content.
► SYSMULTI: Is treated as equivalent to any defined security label. It is intended to be used
by users for access to data that has multilevel data classified.
Assigning security labels
A subject (or user ID) can have more than one security label, but can only use one security
label at a given time. To authorize a subject to use a security label, the security administrator
permits that subject’s user ID to the profile in the RACF SECLABEL resource class for the
security label. Do not forget to RACLIST REFRESH the SECLABEL class.
PERMIT L1C12 CLASS(SECLABEL) ACCESS(READ) ID(USER01)
The security label that a subject uses at a given time can be assigned in a number of ways.
For example, a TSO/E user can specify a security label on the logon panel, and a batch user
can specify a security label on the JOB statement. The default SECLABEL is defined in the
user’s RACF profile.
A resource can have only one security label. For most types of resources, the security
administrator assigns a security label to each resource in the system that is to be protected by
ensuring that the resource is protected by a profile, and by specifying the security label in the
profile.
For DB2 row level security, DB2 maintains the security label in a new column attribute within
the table itself. To implement multilevel security, the DBA adds a column with the security
label data type to an existing table. This is done by defining a column with the AS SECURITY
LABEL attribute. Each row value has a specific SECLABEL. This new column is populated
with security label information when data is inserted into the table. Every row can have a
different security label although this is not likely in practice. More likely, the number of distinct
security labels is much smaller than the number of rows in a table.
How Row Level Security works
Briefly, access to tables is controlled by security labels which are assigned to users as well as
to the data. If the security labels of a user and the data are an equivalent level, that user can
access the data.
Dominance
One security label dominates another security label when both of the following conditions are
true:
Chapter 4. DB2 subsystem performance 193