In this lesson, you will learn how to layer POSIX Access Control Lists (ACLs) with Mandatory Access Control (MAC) systems like SELinux to create a "defense-in-depth" security architecture.
The Two-Layer Approach
To understand the interoperability of these systems, think of them as two separate security gates. POSIX ACLs act as the first gate, managing discretionary access based on user and group identity. SELinux (MAC) acts as the second, stricter gate, enforcing access based on security labels regardless of who owns the file.
When a user tries to access a file, the Linux kernel checks both:
- The DAC/ACL Layer: Does the user have permission according to the ACLs?
- The MAC Layer: Does the security context of the user process match the security label of the file?
If either gate says "deny," the access is blocked. This is a powerful combination because even if an administrator accidentally grants a user excessive access via an ACL, the SELinux policy can still prevent the user from interacting with the file in a way that violates system security.
Practical Implementation
When you manage these together, you must ensure your security context is correctly labeled. For example, if you add an ACL to allow a specific developer to read a sensitive database file, SELinux will still check if that developer’s process is authorized to read files labeled db_t.
You can view both layers using common commands:
# Check the ACLs
getfacl sensitive_data.db
# Check the SELinux label
ls -Z sensitive_data.db
If you modify permissions, always check the labels. If a file is moved to a directory with a different context, the MAC system might block access even if your setfacl command suggests the user has full permissions. Always run restorecon -v sensitive_data.db after moving files to ensure the MAC layer is synchronized with the filesystem's new location.
By maintaining strict ACLs for user management and explicit SELinux policies for service isolation, you ensure that even if one layer is misconfigured or bypassed, the system remains protected.
Key Takeaway: Interoperability relies on the principle that the system performs a logical AND operation—a request must be permitted by both the ACL identity-based rules and the MAC label-based security policy to succeed.