Mandatory Access Control (MAC)
Mandatory access control (MAC) is an access control model where resources are protected by inflexible, system-defined rules.
- a separate group or individual has the authority to set access to resources
- Strictest of all access control models
- implemented in government organizations
- both subjects and objects are given sensitivity labels
- Resources (objects) are given a classification label
- users (subjects) are allocated a clearance level (or label)
- when the labels match, the appropriate permission is granted
- in a confidentiality-oriented system,
- each user can read objects classified at their own clearance level or below
- labeling objects and granting clearance is done with pre-established rules
- rules must be nondiscretionary and cannot be changed by any subject account
- follows the principle of Principle of Least Privilege
- SELinux provides MAC functionality for Linux systems
Info
- As a simple classification system is inflexible,
- so most MAC models add the concept of compartment-based access
- e.g., a data file might be at Secret classification and located in the HR compartment
- Only subjects with Secret and HR clearance could access the file
Info
In MAC, users with high clearance are not permitted to write low-clearance documents.
- This is referred to as write up, read down
- This prevents, for example, a user with Top Secret clearance republishing some Top Secret data that they can access with Secret clearance