search for: l1c5

...he way. A level dominates all levels below it, but compartments do not dominate each other. i.e. a process at level 2 compartments 4 and 5 "dominates" anything at level 1 or level 2 with either no compartments, compartment 4, compartment 5 or both compartments 4 and 5. (i.e. l1, l1c4, l1c5, l1c4c5, l2, l2c4, l2c5, l2c4c5). The implementation I know uses a mixture of modified kernel and modified file systems. Processes are allowed to read down (i.e. read anything they dominate) but "write up" in other words they can only write at their own level or something even more rest...