The basic premise of SELinux seems to control which activities system allows each user, process and daemon, everything beyond the allowed set is block as a default.

Does it mean SELinux effectively overrides conventional DAC or does DAC still play a first role?


SELinux complements DAC, It is an enhancement to DAC. An optional add-on to DAC. Its a patch to DAC with the aim to address various modern day challenges. DAC is old and needed an overhaul. In practice SELinux sits below DAC. So first DAC is enforced and after that SELinux is enforced. Which means that SELinux eventually takes precedence. SELinux does override DAC depending how you look at it. You can use SELinux to prevent access that would otherwise be allowed by DAC but you cannot use SELinux to allow access that would otherwise be prevented by DAC


SE Linux implements Mandatory Access Control, plus trusted path and a few other things, that work in parallel to DAC. If you have read permission to, for example, foo.txt, you must also have a MAC level and category that allows you to access foo. In a sense it overrides DAC, but then DAC can override MAC, so you pays your money and you takes your choice.

It was written for a specific model of confidentiality: it can be and is used for other models, such as constraining daemons and untrusted processes.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.