Mandatory access control

In <a href="/facts/Computer_security/7E5dIy7G">computer security</a>, mandatory access control (MAC) refers to a type of <a href="/facts/Access_control/08zE5Pz8">access control</a> by which a secured environment (e.g., an <a href="/facts/Operating_system/8XTuvMh2">operating system</a> or a database) constrains the ability of a subject or initiator to access or modify on an object or target. In the case of operating systems, the subject is a process or thread, while objects are files, directories, <a href="/facts/Transmission_Control_Protocol/WW4sPrt9">TCP</a>/<a href="/facts/User_Datagram_Protocol/dxLU0D6q">UDP</a> ports, shared memory segments, or IO devices. Subjects and objects each have a set of security attributes. Whenever a subject attempts to access an object, the <a href="/facts/Kernel_(operating_system)/uEj4U3Rz">operating system kernel</a> examines these security attributes, examines the authorization rules (aka policy) in place, and decides whether to grant access. A <a href="/facts/Database_management_system/VYcpkevb">database management system</a>, in its access control mechanism, can also apply mandatory access control; in this case, the objects are tables, views, procedures, etc.
In mandatory access control, the security policy is centrally controlled by a policy administrator and is guaranteed (in principle) to be enforced for all users. Users cannot override the policy and, for example, grant access to files that would otherwise be restricted. By contrast, <a href="/facts/Discretionary_access_control/MTQRM7nr">discretionary access control</a> (DAC), which also governs the ability of subjects to access objects, allows users the ability to make policy decisions or assign security attributes.
Historically and traditionally, MAC has been closely associated with <a href="/facts/Multilevel_security/yyCAmDEP">multilevel security</a> (MLS) and specialized military systems. In this context, MAC implies a high degree of rigor to satisfy the constraints of MLS systems. More recently,[when?] however, MAC has deviated out of the MLS niche and has started to become more mainstream. The more recent MAC implementations, such as <a href="/facts/SELinux/YcTycMEN">SELinux</a> and <a href="/facts/AppArmor/8uBuL9gJ">AppArmor</a> for Linux and <a href="/facts/Mandatory_Integrity_Control/5XGcMsQE">Mandatory Integrity Control</a> for Windows, allow administrators to focus on issues such as network attacks and malware without the rigor or constraints of MLS.

Mandatory access control open-in-new

Mandatory access control