How MACpolicy works
Each database object is assigned a security class.
Top secret (TS), Secret (S), Confidential (C), and Unclassified (U)
The security classes in a system are ordered, and are divided into four classes
TS > S > C > U , where “A > B” means that class A data has a higher security level than class B data.
Each subject requires the necessary clearance to read or write a database object.
Rule #01: Simple Security Property –A subject “S” is allowed to read object “O” only if security class(S)>= class(O).
No read-up rule
Rule #02: Star Property (* property) –A subject “S” is allowed to write object “O” only if class(S)