Mandatory Access Control - Revision history

Tom: /* References */

2025-07-03T17:02:49Z

‎References

Tom: /* Definition */

2025-07-03T17:00:00Z

‎Definition

Tom: /* Key Differences */

2025-07-03T16:54:03Z

‎Key Differences

Tom: /* Key Differences */

2025-07-03T16:48:08Z

‎Key Differences

Tom: /* Key Differences */

2025-07-03T16:43:58Z

‎Key Differences

Tom: /* Definition */

2025-07-03T16:20:08Z

‎Definition

Tom: /* Solutions */

2025-07-03T05:13:00Z

‎Solutions

Tom: /* SELinux */

2025-07-03T05:06:28Z

‎SELinux

Tom: /* SELinux */

2025-07-03T05:02:33Z

‎SELinux

Tom: /* Key Differences */

2025-07-03T04:55:18Z

‎Key Differences

← Older revision		Revision as of 17:02, 3 July 2025
Line 82:		Line 82:
	==References==		==References==

−	[[Category: ~~Access~~]]	+	[[Category: Authorization]]

@@ Line 1: / Line 1: @@
 ==Definition==
-Mandatory Access Control (MAC) and Mandatory Integrity Control (MIC) are both security models that restrict access to resources, but they focus on different goals and are emphasized in different systems.
+Mandatory Access Control (MAC) and Mandatory Integrity Control (MIC) are both security models that restrict access to resources, but they focus on different goals and are emphasized in different systems.<ref>DoD, ''Trusted Computer System Evaluation'' DoD 5200-28 STD 1985-12 </ref>
 ===Mandatory Access Control (MAC)===

@@ Line 52: / Line 52: @@
 Discretionary = The [computing base] shall define and control access between named users and named objects (e.g. files and programs). The enforcement mechanism  (e.g. [[Access Control List]]s)shall allow users to specify and control sharing of those objects by named individuals or defined groups.
-Mandatory - The [computing base] shall enforce a mandatory access control policy over all subject and storage objects(e.g. files, programs, segments and devices).
+Mandatory - The [computing base] shall enforce a mandatory access control policy over all subject and storage objects(e.g. files, programs, segments and devices). These subject and objects shall be assigned sensitivity labels that are a combination of hierarchical classification levels and non-hierarchical categories. The labels shall be used as basis for [[Mandatory Access Control]] decisions.
 ==Solutions==

@@ Line 46: / Line 46: @@
 |-
 |DoD definitions || Bell-LaPadula, no read up, no write down || Biba, no write up, no read down
 |}

@@ Line 44: / Line 44: @@
 |-
 |Typical Use Case || Military, secure servers || Desktop security, sandboxing
 |}
 ==Solutions==

@@ Line 53: / Line 53: @@
 ## SELinux** is a **Linux kernel security module** that enforces **mandatory access control (MAC)** policies.
 ## It was originally developed by the **NSA** and released to the open-source community in 2000. Unlike traditional discretionary access control (DAC), where users and processes can set permissions, **SELinux policies are centrally defined and enforced**, even for root. This makes it much harder for compromised processes to escalate privileges or access unauthorized resources.
 # How It Works
 ## Every **process (subject)** and **resource (object)**—like files, ports, or sockets—has a **security context**.

@@ Line 50: / Line 50: @@
 stands for **Security-Enhanced Linux**—a powerful security architecture built into many Linux distributions.
-### What Is SELinux?
+# What Is SELinux?
-**SELinux** is a **Linux kernel security module** that enforces **mandatory access control (MAC)** policies. It was originally developed by the **NSA** and released to the open-source community in 2000.
+**SELinux** is a **Linux kernel security module** that enforces **mandatory access control (MAC)** policies. It was originally developed by the **NSA** and released to the open-source community in 2000. Unlike traditional discretionary access control (DAC), where users and processes can set permissions, **SELinux policies are centrally defined and enforced**, even for root. This makes it much harder for compromised processes to escalate privileges or access unauthorized resources.
 # How It Works
-Unlike traditional discretionary access control (DAC), where users and processes can set permissions, **SELinux policies are centrally defined and enforced**, even for root. This makes it much harder for compromised processes to escalate privileges or access unauthorized resources.
+## Every **process (subject)** and **resource (object)**—like files, ports, or sockets—has a **security context**.
+## SELinux uses **type enforcement** to define what types of processes can access what types of resources.
----
+## Access decisions are made by checking these contexts against a **policy database**.
 # Modes of Operation
-### How It Works
+##  **Enforcing**: SELinux actively blocks unauthorized actions.
-- Every **process (subject)** and **resource (object)**—like files, ports, or sockets—has a **security context**.
+##  **Permissive**: Violations are logged but not blocked (useful for debugging).
-- SELinux uses **type enforcement** to define what types of processes can access what types of resources.
+##  **Disabled**: SELinux is turned off.
-- Access decisions are made by checking these contexts against a **policy database**.
+## You can check and change the mode via `/etc/selinux/config` or with the `getenforce` and `setenforce` commands.
 # Why It Matters
----
+##  **Limits damage** from compromised services (e.g., a hacked web server can’t access unrelated files).
+##  **Supports fine-grained control** over system behavior.
-### Modes of Operation
+##  **Essential for hardened environments**, especially in government, finance, and cloud deployments.
 ==References==
 [[Category: Access]]

@@ Line 32: / Line 32: @@
 Example: A browser running in “Low” integrity can’t write to a user’s documents folder (which is “Medium”).
 ===Key Differences===
-{|
+{|   border="1" padding="2" width="800px"
 |Feature || MAC (Unix/Linux) || MIC (Windows)
 |-