Star property in read/write access

Question

The * star property requirement for append access [SC(S) <= SC(O)] is looser than for write access [SC(S) = SC(O)]. Can someone explain the reason for this?

Answer 1

Please provide a citation for your claim about write access the star property. I think you may have misinterpreted the condition for write access, or else you mean something different by write than I do.

The star property says the condition for reads is SC(S) >= SC(O), and the standard condition for writes is SC(S) <= SC(O). Neither one involves equality. In short: "read down, write up". The star property is normally discussed in situations where we care about confidentiality (it does nothing to protect integrity).

It is possible you may be thinking of the strong star property. It says that the condition for reads is SC(S) = SC(O) and the condition for writes is SC(S) = SC(O). (Warning: Wikipedia's description of the strong star property is currently incomplete and a bit misleading.) The strong star property could in theory be used when we want to enforce both confidentiality and integrity.

In neither model is append normally treated differently from write, to my knowledge (though it's certainly possible I'm missing something).

Neither rule is typically used in practice, because they are too restrictive. This is especially true for the strong star property, which forbids all interaction between subjects at different clearance levels -- completely unrealistic in practice.

Answer 2

Append should not allow you to delete the original content, so where this works is in environments where the original is the core, and any additions are read with the original in mind.

Write access may let you delete the original, so you could replace data with something new. This may not be the behaviour you want.