In computer security, mandatory access control (MAC) refers to a type of access control by which the operating system constrains the ability of a subject or initiator to access or generally perform some sort of operation on an object or target.

learn more… | top users | synonyms

1
vote
1answer
26 views

Defense-In-Depth With Common Security Controls

Many operating systems implement system capabilities, Posix access controls (DAC/ACLs) and mandatory access controls (SELinux), each using different underlying security controls to provide individual ...
1
vote
2answers
136 views

How to forbid one directory only in TOMOYO (2.5)?

(For example) I want to restrict write access to /home/backup from anybody, except a particular backup script. (To protect from accidental deletion.) For this, I suppose, it is enough to have two ...
4
votes
1answer
56 views

Are Linux System Capabilities Considered Mandatory Access Controls?

DAC is not mandatory because access permissions are left up to the resource owner's discretion. Mandatory Access Control (Smack, SELinux, etc) administration can only be accomplished by a ...
3
votes
2answers
54 views

Where do Access Controls Fit into the Parkerian Hexad?

The security elements of the Parkerian Hexad are: Confidentiality Possession or Control Integrity Authenticity Availability Utility Where do access controls (mandatory, discretionary and ACL) fit ...
0
votes
1answer
33 views

Who is the Mandatory Access Control Administrator

Would a mandatory access control implementation administered by a 'normal' user be discretionary since the user could change permissions as he sees fit? And if so, wouldn't root as a MAC admin, being ...
0
votes
1answer
89 views

Difference Between MAC and DAC

Are the only difference between DAC and MAC: the fact that MAC can also dictate DAC-type permissions to processes, not just users and name space objects? (files,etc) And there's no concept of ...
2
votes
1answer
77 views

Protecting a database against insiders

Consider a network for a web-application with 1 webserver and 1 MySQL database, both on physically different servers and both running Linux. The database stores mission critical data and this data is ...
9
votes
6answers
1k views

What is preventing the widespread common use of MAC-type systems?

Overall question What is preventing the uptake of MAC systems such as SELinux/AppArmor in corporate and desktop computing environments? Why don't you think it isn't already widespread? I do not ...
3
votes
1answer
1k views

What is a visible example for a mandatory access control (MAC)

I can see clearly how discretionary access control (DAC) works by checking the properties of a file on my MSWindows machine, the file has attributes and the owner of the file can do almost anything ...
4
votes
2answers
1k views

What are the practical differences between SELinux targeted mode and a capability based OS?

I recently asked a question about the differences between capabilities and mandatory access controls. Among the answers I got the point was made that systems like SE Linux in targeted mode are not a ...
10
votes
3answers
2k views

Security tradeoffs of pathname-based MAC (e.g., TOMOYO, grsecurity, AppArmor, …)

I have been learning about MAC (Mandatory Access Control) systems in Linux. Often, but not always, these are tied to Linux Security Modules. Some systems I've looked at: SELinux, Tomoyo, AppArmor, ...
1
vote
1answer
830 views

Physical vs Logical - Location/Address

According to the CJIS Security Policy - Access Enforcement The information system shall enforce assigned authorizations for controlling access to the system and contained information. The ...
2
votes
2answers
757 views

Apparmor system-wide security — white-listing

I want to only white-list applications that can run on my system using Apparmor, I know it is used to confine applications/programs based on their path names, but what I need is to contain those ...
1
vote
2answers
201 views

Mandatory Access Control Rulesets, how to deal with Python, Bash and other interpreters?

Question (a) Is there? and if so (b) what is a standard or accepted way for MAC systems to deal with complex software and in particular with Python, Bash and other interpreters? (in terms of ...
1
vote
1answer
405 views

Can HIPS software practically be considered a form of MAC

Host Intrusion Prevention Software can restrict applications from taking certain actions regardless if they have the privileged to do so as assigned by the operating system. Given that with the use ...
7
votes
5answers
1k views

What is the practical difference between MAC and Capabilities

Both Mandatory Access Controls and Capabilities allow for fine grained privileges to be assigned to applications irrespective or in place of privileges inherited by the running user. Is there any ...
5
votes
3answers
4k views

Bell-LaPadula imlementation example

I'm currently studying the Bell-LaPadula model and i need to do an implementation as an example. I understand how the model works, but I have difficulties implementing it in a programming language ...