In this lesson, you will learn the fundamental difference between the flexible, user-driven permissions you have used until now (Discretionary) and the rigid, system-wide constraints imposed by the kernel (Mandatory).
Discretionary Access Control (DAC)
Everything you have learned up to this point—chmod, chown, and POSIX ACLs—falls under Discretionary Access Control. In a DAC system, the "discretion" to define access lies with the file owner. If you own a file, you decide who gets to read or write to it.
The primary security limitation of DAC is that permissions are tied to the user. If a malicious process runs under your user account, it inherits all your permissions. It can modify or delete any file you own, because the system "discretions" allow you to do so.
Mandatory Access Control (MAC)
Mandatory Access Control shifts the power away from the user and places it in the hands of a central security policy defined by the system administrator. In a MAC-enabled system (like SELinux or AppArmor), the kernel acts as a strict referee.
Even if you own a file and set the permissions to 777 (world-writable), a MAC policy can forbid a specific application from touching that file. The kernel ignores your "discretion" if the application's assigned security label does not explicitly permit the action.
A Concrete Illustration
Imagine a web server process running on your machine:
- Under DAC: If the web server runs as your user, it can read your private SSH keys simply because you own them and the file permissions allow group/other access.
- Under MAC: The kernel enforces a policy that says: "The web server process is only allowed to access files in
/var/www/html." Even if the web server process has root-like capabilities or permissions to read your home directory, the MAC policy will reject the request at the kernel level because the access is not explicitly permitted by the security policy.
DAC is about who you are, while MAC is about what the process is allowed to do, regardless of who owns it.
Key Takeaway: DAC grants permissions based on user ownership and discretion, whereas MAC enforces security policies globally through the kernel, overriding individual user-defined permissions.