4

DAC is not mandatory because access permissions are left up to the resource owner's discretion.

Mandatory Access Control (Smack, SELinux, etc) administration can only be accomplished by a process/user with CAP_MAC_ADMIN (or root).

Since MAC wouldn't hinge on any discretionary controls to enforce mandatory controls, are Linux System Capabilities considered Mandatory?

Improve this question

1 Answer 1

Reset to default
2

Generally capabilities are a good way of implementing a Mandatory Access Control system (see Eros OS, for example).

The Linux system capabilities affect objects which can be under both DAC and MAC. They also don't seem to break the possibility to do MAC since you can limit altering capabilities using the bounding set. Once you remove the ability to alter MAC settings from the bounding set on all processes, then you have full MAC on the system. Of course implementation bugs may make this wrong. If you don't remove the alter MAC capabilities then processes that have them are able to treat mandatory access controls as discretionary. If any of those processes (or files they start from) are not part of the "trusted computing base" for your system then what you have is a system configured with discretionary access control.

I think the best answer to your question is: system capabilities are designed to support and could be part of a mandatory access control implementation, incorrectly configured they could also break mandatory access control.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .