Are the only difference between DAC and MAC:
- the fact that MAC can also dictate DAC-type permissions to processes, not just users and name space objects? (files,etc)
- And there's no concept of resource owner in MAC just access rights?
No, the intended difference is that MAC says the security officer has given me access to, for example, the SDE compartment. Within it, there are files I can set (DAC) acls on, but no matter what access I assign you, the MAC will stop you from reading those files unless you also have been cleared for access to SDE.
Discretionary access is under my control Mandatory access is under senior management control MAC always trumps DAC