CyberGlossary

Identity & Access

Mandatory Access Control (MAC)

Also known as: MAC, Non-discretionary access control

Definition

An access-control model in which a central policy — not the resource owner — enforces access decisions based on classifications and clearances assigned to subjects and objects.

Mandatory Access Control is a non-discretionary model where the operating system or kernel enforces a system-wide policy that users cannot override. Every subject (process) and object (file, network port) is tagged with a security label such as a classification level (Top Secret, Secret, Confidential) or a category, and access is allowed only when the labels satisfy the policy (for example, Bell-LaPadula's "no read up, no write down"). MAC is mandatory because even a file's owner cannot relax its permissions. It is implemented in SELinux, AppArmor, Smack, FreeBSD MAC, and was originally developed for military and high-assurance environments. The cost is rigidity, complex labelling, and a steep operational learning curve.

Examples

  • SELinux blocking a web server process from reading /etc/shadow even when running as root.
  • A classified system preventing a Secret user from writing to an Unclassified directory.

Related terms