I used to run Trusted Solaris 7, to separate possibly-unfriendly customers, and it would happily put up windows with the category and security level shown, and refuse to copy between them if the recipient's credentials didn't dominate the sender's.

The category stuff would work well with SELinux, and I'd use it today if I could. The levels (Secret, Top Secret, etc) less so.

--dave collier-brown
davecb@spamcop.net