Assign Roles

Another set of roles contained in all role definitions is called Assign Roles. It defines, which roles processes running this certain role are allowed to assign as compatible role to roles, as default role to users or as initial or forced role to program files or processes.

• assignroles(r:role):set of roles := set of assignable roles for role r
• addcomprole$_{tn}$(p:process, r$_1$:role, r$_2$:role) := process p adds role r$_1$ to the set of compatible roles of role r$_2$ at time n
• assigndefrole$_{tn}$(p:process, r:role, u:user) := process p assigns default role r to user u at time n
• assigninitialrole$_{tn}$(p:process, r:role, f:file) := process p assigns initial role r to program file f at time n
• assignforcedrole$_{tn}$(p:process, r:role, f:file) := process p assigns forced role r to program file f at time n
• assignforcedrole$_{tn}$(p$_1$:process, r:role, p$_2$:process) := process p$_1$ assigns forced role r to process p$_2$ at time n

$$\mathrm{addcomprole}_{tn}(\mathrm{p},\mathrm{r}_1,\mathrm{r}_2) \Rightarrow \mathrm{r}_1 \in \mathrm{assignroles}_{tn}(\mathrm{currentrole}_{tn}(\mathrm{p}))$$

$$\wedge \mathrm{r}_2 \in \mathrm{adminroles}_{tn}(\mathrm{currentrole}_{tn}(\mathrm{p}))$$ (25)

Default roles can only be assigned to users, if both the old and the new role are in the set of Assign Roles. This restriction, together with the sets of compatible roles, creates a range of reachable roles, which easily forms a workgroup.

$$\mathrm{assigndefrole}_{tn}(\mathrm{p,r,u}) \Rightarrow\ \ma... ...athrm{assignroles}_{tn}(\mathrm{currentrole}_{tn}(\mathrm{p}))$$ (26)

To set an initial or forced role for a program file or process object, the additional right MODIFY_ATTRIBUTE to the type of the object is needed.

$${\mathrm{assigninitialrole}_{tn}(\mathrm{p,r,f}) \Rightarrow}$$

$$r \in \mathrm{assignroles}_{tn}(\mathrm{currentrole}_{tn}(\mathrm{p}))$$

$$\wedge \mathrm{compatible}_{tn}(\mathrm{currentrole}_{tn}(\mathrm{p}), \mathrm{efftype}_{tn}(\mathrm{f}), \mathrm{MODIFY\_ATTRIBUTE})$$ (27)

$${\mathrm{assignforcedrole}_{tn}(\mathrm{p,r,f}) \Rightarrow}$$

$$\mathrm{r} \in \mathrm{assignroles}_{tn}(\mathrm{currentrole}_{tn}(\mathrm{p}))$$

$$\wedge \mathrm{compatible}_{tn}(\mathrm{currentrole}_{tn}(\mathrm{p}), \mathrm{efftype}_{tn}(\mathrm{f}), \mathrm{MODIFY\_ATTRIBUTE})$$ (28)

$${\mathrm{assignforcedrole}_{tn}(\mathrm{p}_1,\mathrm{r},\mathrm{p}_2) \Rightarrow}$$

$$\mathrm{r} \in \mathrm{assignroles}_{tn}(\mathrm{currentrole}_{tn}(\mathrm{p}_1))$$

$$\wedge \mathrm{compatible}_{tn}(\mathrm{currentrole}_{tn}(\mathrm{p}_1), \mathrm{type}_{tn}(\mathrm{p}_2), \mathrm{MODIFY\_ATTRIBUTE})$$

Changes to the Assign Roles set of any role are restricted to roles with Admin Type value Role Admin.

• changeassignroles$_{tn}$(p:process, r:role) := process p changes the set of assign roles of role r at time n

$$\mathrm{changeassignroles}_{tn}(\mathrm{p,r}) \Rightarrow\ \... ...(\mathrm{currentrole}_{tn}(\mathrm{p})) = \mathrm{role\_admin}$$ (29)