Difference between revisions of "Mandatory Access Control"
(→SELinux) |
(→SELinux) |
||
| Line 51: | Line 51: | ||
# What Is SELinux? | # What Is SELinux? | ||
| − | + | ## SELinux** is a **Linux kernel security module** that enforces **mandatory access control (MAC)** policies. | |
| + | ## It was originally developed by the **NSA** and released to the open-source community in 2000. Unlike traditional discretionary access control (DAC), where users and processes can set permissions, **SELinux policies are centrally defined and enforced**, even for root. This makes it much harder for compromised processes to escalate privileges or access unauthorized resources. | ||
# How It Works | # How It Works | ||
## Every **process (subject)** and **resource (object)**—like files, ports, or sockets—has a **security context**. | ## Every **process (subject)** and **resource (object)**—like files, ports, or sockets—has a **security context**. | ||
Revision as of 22:06, 2 July 2025
Contents
Definition
Mandatory Access Control (MAC) and Mandatory Integrity Control (MIC) are both security models that restrict access to resources, but they operate at different conceptual layers and are used in different systems. Here's how they compare:
Mandatory Access Control (MAC)
What it is: A strict access control model where the operating system enforces policies defined by a central authority—not by individual users.
Used in: Unix/Linux systems (e.g., SELinux, AppArmor), military and government environments.
How it works:
Every user and resource is assigned a security label (e.g., Top Secret, Confidential).
Access is granted only if the user’s clearance matches or exceeds the resource’s classification.
Goal: Prevent unauthorized information flow and enforce confidentiality.
Example: A user with “Secret” clearance cannot access a “Top Secret” file, even if file permissions allow it.
Mandatory Integrity Control (MIC)
What it is: A Windows-specific model introduced in Windows Vista that enforces integrity levels to prevent lower-trust processes from modifying higher-trust objects.
Used in: Microsoft Windows (Vista and later).
How it works:
Objects and processes are labeled with integrity levels: Low, Medium, High, or System.
A process with a lower integrity level cannot write to or modify an object with a higher level—even if it has permission via ACLs.
Goal: Protect system integrity by isolating untrusted code (e.g., web browsers, downloaded files).
Example: A browser running in “Low” integrity can’t write to a user’s documents folder (which is “Medium”).
Key Differences
| Feature | MAC (Unix/Linux) | MIC (Windows) |
| Focus | Confidentiality and classification | System integrity and trustworthiness |
| Label Type | Security classification (e.g., Secret) | Integrity level (e.g., Low, Medium) |
| Granularity | User and object-based | Process and object-based |
| Policy Control | Centralized, non-discretionary | Enforced by OS, layered over ACLs |
| Typical Use Case | Military, secure servers | Desktop security, sandboxing |
Solutions
SELinux
stands for **Security-Enhanced Linux**—a powerful security architecture built into many Linux distributions.
- What Is SELinux?
- SELinux** is a **Linux kernel security module** that enforces **mandatory access control (MAC)** policies.
- It was originally developed by the **NSA** and released to the open-source community in 2000. Unlike traditional discretionary access control (DAC), where users and processes can set permissions, **SELinux policies are centrally defined and enforced**, even for root. This makes it much harder for compromised processes to escalate privileges or access unauthorized resources.
- How It Works
- Every **process (subject)** and **resource (object)**—like files, ports, or sockets—has a **security context**.
- SELinux uses **type enforcement** to define what types of processes can access what types of resources.
- Access decisions are made by checking these contexts against a **policy database**.
- Modes of Operation
- **Enforcing**: SELinux actively blocks unauthorized actions.
- **Permissive**: Violations are logged but not blocked (useful for debugging).
- **Disabled**: SELinux is turned off.
- You can check and change the mode via `/etc/selinux/config` or with the `getenforce` and `setenforce` commands.
- Why It Matters
- **Limits damage** from compromised services (e.g., a hacked web server can’t access unrelated files).
- **Supports fine-grained control** over system behavior.
- **Essential for hardened environments**, especially in government, finance, and cloud deployments.
