Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

The * star property requirement for append access [SC(S) <= SC(O)] is looser than for write access [SC(S) = SC(O)]. Can someone explain the reason for this?

share|improve this question
As I explain in my answer, I think the question's premise is faulty: that's not the correct statement of the requirement for write access. – D.W. Sep 7 '12 at 7:42

Append should not allow you to delete the original content, so where this works is in environments where the original is the core, and any additions are read with the original in mind.

Write access may let you delete the original, so you could replace data with something new. This may not be the behaviour you want.

share|improve this answer

Please provide a citation for your claim about write access the star property. I think you may have misinterpreted the condition for write access, or else you mean something different by write than I do.

The star property says the condition for reads is SC(S) >= SC(O), and the standard condition for writes is SC(S) <= SC(O). Neither one involves equality. In short: "read down, write up". The star property is normally discussed in situations where we care about confidentiality (it does nothing to protect integrity).

It is possible you may be thinking of the strong star property. It says that the condition for reads is SC(S) = SC(O) and the condition for writes is SC(S) = SC(O). (Warning: Wikipedia's description of the strong star property is currently incomplete and a bit misleading.) The strong star property could in theory be used when we want to enforce both confidentiality and integrity.

In neither model is append normally treated differently from write, to my knowledge (though it's certainly possible I'm missing something).

Neither rule is typically used in practice, because they are too restrictive. This is especially true for the strong star property, which forbids all interaction between subjects at different clearance levels -- completely unrealistic in practice.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.