Questions tagged [mandatory-access-control]
In computer security, mandatory access control (MAC) refers to a type of access control by which the operating system constrains the ability of a subject or initiator to access or generally perform some sort of operation on an object or target.
36 questions
0
votes
0
answers
73
views
How to add SMACK rule for controlling mmap of shared lib via SMACK64MMAP extended attribute
I am new to SMACK and trying to explore SMACK64MMAP attribute and how it works. Basically, I want to control which process can map my shared library.
Hence, I am adding a label to SMACK64MMAP ...
- 1
2
votes
1
answer
368
views
Can a subject in Bell-LaPadula model write to other files with different compartments but same classification?
my question is based on the post made Toaster which never got a reply (Bell-LaPadula Model Compartments). In BLP If a subject has a classification level General and compartment Land (General, {Land}), ...
- 31
3
votes
1
answer
1k
views
Why does this Windows process run with High integrity?
Background
I'm trying to understand more about the Mandatory Integrity Control system in Windows, and have been looking through the background processes that are running at High integrity on my laptop....
- 133
9
votes
2
answers
2k
views
How is MAC useful?
I know what mandatory access control (MAC) is, but I don't see how it helps. Often it seems to be said that if you have something like SELinux or AppArmor enabled you are magically more secure. And ...
- 973
0
votes
1
answer
118
views
Difference between access control systems that can/can't be compromised without valid credentials?
Take the following examples:
When I run sshd, it can in theory grant access to anything that the process itself has access to, regardless of provided credentials. For example, I could in theory ...
- 103
2
votes
2
answers
1k
views
Linux whitelist-based Mandatory Access Control instead of a blacklist-based model
I'm trying to harden a Linux installation on a personal computer - I decided to try both SELinux and AppArmor as a Mandatory Access Control (MAC) to supplement the default Discretionary Access Control ...
- 131
5
votes
4
answers
357
views
Real value of MAC models in Linux
I have read about MAC vs. DAC in the Internet, but I still fail to understand, what kind of attack it is impossible to protect against if one only uses DAC+capabilities in comparison to MAC+DAC+...
- 151
3
votes
1
answer
3k
views
Is apparmor default deny?
Is apparmor default deny? For example consider the case under SELinux in enforcing mode, where I install a package with no policy associated with it. SELinux's default behaviour is to deny all ...
- 183
3
votes
3
answers
6k
views
Why is linux filesystem considered DAC and not MAC
Citing wikipedia's MAC article:
With mandatory access control, this security policy is centrally
controlled by a security policy administrator; users do not have the
ability to override the ...
- 183
3
votes
1
answer
3k
views
Are Bell-LaPadula and Biba models used in real big software security design?
I am currently studying both Bell-LaPadula and Biba models, I found this models too theoretical as I see the examples and I can see that there are used for designing particular services that needs ...
3
votes
1
answer
306
views
Can a badly configured AppArmor profile reduce security?
Can a badly or even maliciously configured AppArmor profile reduce security, or can it only improve it? I read that apparently AppArmor cannot override unix file permissions, so it shouldn't give a ...
- 15.9k
1
vote
1
answer
984
views
What are the security risks of running a daemon as root even though SELinux is enforcing?
On an board running Linux I see a daemon and an utility run under root when started. The SELinux is enforcing for this system.
Are there any potential threats of running as root, even if the SELinux ...
- 225
0
votes
1
answer
7k
views
Question about compare Bell-LaPadula and Biba models with Chinese wall policy
what the Chinese wall models try to achieve and how it differ from or improve upon the Bell-LaPadula and Biba models
- 11
4
votes
1
answer
370
views
Can too restrictive Linux MAC policy decrease security?
Can too restrictive MAC profile (e.x. AppArmor profile) decrease application security?
For example: could it be that too restrictive environment for web browser will protect host system very well ...
- 263
2
votes
1
answer
1k
views
Isn't RBAC just an implementation of MAC?
So I've been reading up on MAC vs DAC vs RBAC and there is something which I do not understand. Everywhere you read, it tells you that these types are different (disjoint) but isn't RBAC just a type (...
- 121
0
votes
2
answers
627
views
Lattice vs Level with regard to access control
With regard to access control, is "lattice" the same as "level"? Is "Multi-level access control" just another name of "lattice-based access control"?
Are Biba and Bell-LaPadula Security Models ...
- 330
5
votes
1
answer
2k
views
Do AppArmor/SELinux provide any security for workstation?
I decided to harden security on my primary workstation a bit. Before I used to use firejail for certain less trusted apps (all apps with internet access) but it's kind of toy. Didn't work really well ...
- 217
2
votes
1
answer
2k
views
linux kernel security module smack transmutation example
In the kernel documentation for smack security module it reads: "If a directory is marked as transmuting (SMACK64TRANSMUTE=TRUE) and the access rule that allows a process to create an object in that ...
- 165
2
votes
0
answers
492
views
Integrity Label management
How can I read and modify the Integrity Labels of specified user folders and files on Windows 7 and later via the command line. For my use case, I need the command to be able to read the Integrity ...
- 21
4
votes
3
answers
662
views
Defense-In-Depth With Common Security Controls
Many operating systems implement system capabilities, Posix access controls (DAC/ACLs) and mandatory access controls (SELinux), each using different underlying security controls to provide individual ...
- 1,279
4
votes
1
answer
770
views
Are Linux System Capabilities Considered Mandatory Access Controls?
DAC is not mandatory because access permissions are left up to the resource owner's discretion.
Mandatory Access Control (Smack, SELinux, etc) administration can only be accomplished by a process/...
- 1,279
3
votes
2
answers
244
views
Where do Access Controls Fit into the Parkerian Hexad?
The security elements of the Parkerian Hexad are:
Confidentiality
Possession or Control
Integrity
Authenticity
Availability
Utility
Where do access controls (mandatory, discretionary and ACL) fit in?...
- 1,279
1
vote
1
answer
3k
views
Difference Between MAC and DAC
Are the only difference between DAC and MAC:
the fact that MAC can also dictate DAC-type permissions to processes, not just users and name space objects? (files,etc)
And there's no concept of ...
- 1,279
0
votes
1
answer
615
views
Who is the Mandatory Access Control Administrator
Would a mandatory access control implementation administered by a 'normal' user be discretionary since the user could change permissions as he sees fit? And if so, wouldn't root as a MAC admin, being ...
- 1,279
3
votes
1
answer
358
views
Protecting a database against insiders
Consider a network for a web-application with 1 webserver and 1 MySQL database, both on physically different servers and both running Linux. The database stores mission critical data and this data is ...
- 469
6
votes
1
answer
13k
views
What is a visible example for a mandatory access control (MAC)
I can see clearly how discretionary access control (DAC) works by checking the properties of a file on my MSWindows machine, the file has attributes and the owner of the file can do almost anything ...
- 8,843
1
vote
1
answer
2k
views
Physical vs Logical - Location/Address
According to the CJIS Security Policy -
Access Enforcement
The information system shall enforce assigned authorizations for
controlling access to the system and contained information. The
...
- 111
3
votes
3
answers
5k
views
Apparmor system-wide security -- white-listing
I want to only white-list applications that can run on my system using Apparmor, I know it is used to confine applications/programs based on their path names, but what I need is to contain those ...
- 153
1
vote
2
answers
557
views
Mandatory Access Control Rulesets, how to deal with Python, Bash and other interpreters?
Question
(a) Is there? and if so (b) what is a standard or accepted way for MAC systems to deal with complex software and in particular with Python, Bash and other interpreters? (in terms of ...
- 1,472
12
votes
3
answers
4k
views
Security tradeoffs of pathname-based MAC (e.g., TOMOYO, grsecurity, AppArmor, ...)
I have been learning about MAC (Mandatory Access Control) systems in Linux. Often, but not always, these are tied to Linux Security Modules. Some systems I've looked at: SELinux, Tomoyo, AppArmor, ...
- 1,472
1
vote
2
answers
295
views
How to forbid one directory only in TOMOYO (2.5)?
(For example) I want to restrict write access to /home/backup from anybody, except a particular backup script. (To protect from accidental deletion.) For this, I suppose, it is enough to have two ...
- 215
6
votes
2
answers
4k
views
What are the practical differences between SELinux targeted mode and a capability based OS?
I recently asked a question about the differences between capabilities and mandatory access controls.
Among the answers I got the point was made that systems like SE Linux in targeted mode are not a ...
- 3,606
1
vote
1
answer
717
views
Can HIPS software practically be considered a form of MAC
Host Intrusion Prevention Software can restrict applications from taking certain actions regardless if they have the privileged to do so as assigned by the operating system.
Given that with the use ...
- 3,606
9
votes
5
answers
3k
views
What is the practical difference between MAC and Capabilities
Both Mandatory Access Controls and Capabilities allow for fine grained privileges to be assigned to applications irrespective or in place of privileges inherited by the running user.
Is there any ...
- 3,606
8
votes
3
answers
12k
views
Bell-LaPadula imlementation example
I'm currently studying the Bell-LaPadula model and i need to do an implementation as an example.
I understand how the model works, but I have difficulties implementing it in a programming language (...
- 81
11
votes
6
answers
2k
views
What is preventing the widespread common use of MAC-type systems?
Overall question
What is preventing the uptake of MAC systems such as SELinux/AppArmor in corporate and desktop computing environments?
Why don't you think it isn't already widespread?
I do not ...
user2213