2

What is the reason for UNIX-like access permissions (both the traditional user-group-others and extended ACLs) being classified as a form of DAC (Discretionary Access Control) system and not MAC (Mandatory AC)?

What would be required for them to be considered being a MAC system?

Improve this question
1
  • Manditory as in user is limited by external authority not in charge (discretionary).
    – zedman9991
    Commented Apr 5, 2013 at 12:43

3 Answers 3

Reset to default
5

With UNIX file permissions, access control is at the discretion of the file's owner. The owner may opt for no control on the file (e.g., 0777). This is distinct from mandatory systems, where access control is not simply up to the object's owner.

Improve this answer
3

To really understand what a MAC system looks like, you first need some definitions:

  • Subject. This is the component requesting access to an object.
  • Object. This is the object on which access is requested.
  • Activity. This is the action type the subject wishes to perform upon the object.

The real "problem" with Unix ACLs is that "subject" only applies to users. In a mandatary access control system processes themselves are also subjects in their own right. The reason Unix ACLs are discretionary, therefore, is that the various subjects in the system are allowed to inherit/assume the permissions that the user or group has.

MAC systems do not work like this. In a MAC system, a process is given its own rules and may be able to extend beyond the power of the user, or be further restricted than the user, depending on the policy.

To turn this system into a full MAC system, you would probably need to redesign it - as it stands, it just doesn't have the capacity to support MAC.

Improve this answer
6
  • I have to admit I don't really understand your answer - any process (read "code") running on a UNIX system has some defined rights. Yet these are set by the administrator and enforced by the kernel (at least in theory) - the user has nothing to do with it and in most cases can do nothing to change it. The exception is elevating one's privileges through su and similar, but these are again system wide policies. The answer would make sense to me if one changed inherit/assume the permissions to change the permissions to the object though. Would that make sense?
    – peterph
    Commented Apr 5, 2013 at 13:59
  • @peterph the basic difference is that each process under DAC inherits the permissions you have, whereas under MAC it does not. So when you run a process, say, "echo", it runs as you and can do anything you can. In that sense it is discretionary since the process is just assumed to have the same permissions you have regardless. This isn't true of MAC systems, where processes only inherit permissions like that if the rules say they can. Instead, "echo" runs with its own permissions. It is possible to configure a file to be readable in vim, but not via echo, for example.
    – user2213
    Commented Apr 5, 2013 at 14:53
  • As a practical example, on Fedora based systems, apache runs as http_exec_t transitioning to httpd_t and can access files labelled httpd_sys_content_t. It runs as whichever user you let it run as, say wwwuser, but if the files in /var/www are not labelled correctly it will not be able to see them.
    – user2213
    Commented Apr 5, 2013 at 14:55
  • OK I see the point, then the definitions you have used in the answer seem to be too vague - the triple (subject = code running with privileges of a particular user, object = file, action = open object) satisfies the definitions. Basically it revolves around the precise border between subject and action. Or is it that I have wrong lexical context (i.e. the system one instead of the security one)?
    – peterph
    Commented Apr 5, 2013 at 15:21
  • @peterph they have to be vague, unfortunately - subject is usually a process but could also be a thread, object can be a file, shared memory, a pipe, a tcp socket, action could be any system call you can imagine - so yes, you're right, it's about the precise border. MAC defines that much much more rigorously than DAC.
    – user2213
    Commented Apr 5, 2013 at 15:46
2

In the Unix the creator of the file or directory decides who can access it. Unix distinct the rights in three different categories read, write, execute and have tree different user groups, owner group others.

In a system that uses MAC their is a central policy on which files the users can access.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .