A demonstration may be of help here. Let's say that there are three security clearance levels: top secret, secret, and unclassified. Let's assign our User (U1) the secret status. In this case, your (a) claim

U1 must have a higher/equal security level than O1.

is correct, because U1 can read but not write to the file (the star property). To prohibit read access for U1 on O2, the second object, the object would require top secret level clearance.

But what about write access? A controller of 02 at the top secret level can rescind access to that object from a subject. Rescinding access would therefore prevent U1 from writing up to 02.

For more information, see: http://courses.cs.vt.edu/~cs5204/fall99/protection/harsh/

A demonstration may be of help here. Let's say that there are three security clearance levels: top secret, secret, and unclassified. Let's assign our User (U1) the secret status. In this case, your (a) claim

U1 must have a higher security level than O1.

is correct, because U1 can read but not write to the file (the star property). To prohibit read access for U1 on O2, the second object, the object would require top secret level clearance.

But what about write access? A controller of 02 at the top secret level can rescind access to that object from a subject. Rescinding access would therefore prevent U1 from writing up to 02.

For more information, see: http://courses.cs.vt.edu/~cs5204/fall99/protection/harsh/