In this lesson, you will learn the core conceptual difference between Discretionary Access Control (DAC) and Mandatory Access Control (MAC) and why the latter is fundamental to Linux security.
The Problem with DAC
In traditional Linux environments, we rely on Discretionary Access Control (DAC). Under DAC, the owner of a file or process has the "discretion" to decide who gets access. If you chmod 777 a sensitive configuration file, the system allows it because you own the file. The security of the system relies entirely on the user's judgment and the integrity of the user account. If a user account is compromised, the attacker inherits all the permissions that the user has, allowing them to traverse the system at will.
The MAC Philosophy
Mandatory Access Control (MAC) flips this paradigm. Instead of relying on user discretion, the system enforces a central security policy defined by an administrator. Even if you own a file, you cannot grant access to it if the system-wide policy prohibits that action.
Think of it as the difference between a house guest and a secure facility:
- DAC is like your home: You choose who to invite and what they can touch. If you make a bad decision, your home is vulnerable.
- MAC is like a high-security lab: Even if you are an employee, you cannot enter the vault unless the central security policy explicitly permits you to do so based on your security label.
In a MAC-enabled environment (like SELinux or AppArmor), processes are constrained by profiles. Even if a web server process is running as root (a DAC nightmare), a MAC policy can restrict it so it can only read from /var/www/html and never touch /etc/shadow.
# DAC perspective:
# If the process is compromised, it can read any file the owner can read.
# MAC perspective:
# Even if compromised, the process is restricted by its assigned security label:
# "Process Label: httpd_t" can only access "File Label: httpd_sys_content_t"
The philosophy of MAC is "least privilege by default, enforced by the kernel, not by the user."
Key Takeaway: DAC is based on user identity and owner discretion, whereas MAC is based on central policy enforcement that overrides user privileges to contain potential threats.