To really understand what a MAC system looks like, you first need some definitions:
- Subject. This is the component requesting access to an object.
- Object. This is the object on which access is requested.
- Activity. This is the action type the subject wishes to perform upon the object.
The real "problem" with Unix ACLs is that "subject" only applies to users. In a mandatary access control system processes themselves are also subjects in their own right. The reason Unix ACLs are discretionary, therefore, is that the various subjects in the system are allowed to inherit/assume the permissions that the user or group has.
MAC systems do not work like this. In a MAC system, a process is given its own rules and may be able to extend beyond the power of the user, or be further restricted than the user, depending on the policy.
To turn this system into a full MAC system, you would probably need to redesign it - as it stands, it just doesn't have the capacity to support MAC.