DB2 UDB for z/OS Version 8 Performance Topics - IBM Redbooks

► The security level that defines the first security label is greater than or equal to the security
level that defines the second security label.
► The set of security categories that defines the first security label includes the set of
security categories that defines the second security label.
You can also look at dominance in a simplistic way as one security label being “greater than”
another.
Reverse dominance
With reverse dominance access checking, the access rules are the reverse of the access
rules for dominance access checking. This type of checking is not used by DB2.
In loose terms, it can be looked as “less than or equal to” checking.
Equivalence
Equivalence of security labels means that either the security labels have the same name, or
they have different names but are defined with the same security level and identical security
categories.
You can look at this type of checking as “equal to” checking. (One way to check is if both
dominance and reverse dominance are true.)
Disjoint
Two security labels are considered disjoint when they have at least one category that the
other does not have. Neither of the security labels dominates the other.
Read-up
Multilevel security controls prevent unauthorized individuals from accessing information at a
higher classification than their authorization. It does not allow users to “read-up” or read
above their authorization level. Read-up is enforced through dominance checking.
Write-down
Multilevel security also prevents individuals from declassifying information. This is also known
as write-down, that is, writing information back at a lower level (down-level) than its current
classification. Write-down is prevented by doing equivalence checking.
However, there may be cases where you want to allow write-down by selected individuals.
The security administrator controls whether write-down is allowed at the system level by
activating and deactivating the RACF MLS(FAILURES) option (using the SETROPTS
command), or for controlled situations of write-down in which z/OS allows the security
administrator to assign a “write-down by user” privilege to individual users that allows those
users to select the ability to write down. To do so, a user has to have at least read authority on
the IRR.WRITEDOWN.BYUSER profile in the RACF FACILITY class.
Accessing data
When a query fetches data from a table, DB2 checks the security label of the user submitting
the query to the security label of the row. If there is a match (equivalent or dominating), the
row is returned to the user. To perform this check, DB2 invokes RACROUTE for the
determination. DB2 also caches the decision made by RACF so that subsequent rows with
the same data security label could be determined locally.
For more detail on Multilevel Security, see z/OS Planning for Multilevel Security and Common
Criteria, SA22-7509, and the recent book, z/OS Multilevel Security and DB2 Row-level
Security Revealed, SG24-6480.
194 DB2 UDB for z/OS Version 8 Performance Topics