🔐Mandatory Access Control

NEW

An access control model enforcing system-wide policies by a central authority rather than resource owners.

DESCRIPTION

Mandatory Access Control enforces access decisions based on centrally defined policies and object labels. Users cannot override rules, supporting strong isolation and compliance requirements. MAC is common in high-assurance systems and OS security frameworks like SELinux. It often uses security levels and categories to ensure only authorized subjects access sensitive objects. Compared to DAC and RBAC, MAC is stricter and less flexible but more resistant to user misconfiguration.

ALTERNATIVE DEFINITIONS

NIST Computer Security Resource Center

Mandatory Access Control (MAC) is a means of restricting access to objects based on the sensitivity of the information and the formal authorization of subjects to access information of such sensitivity.

Highlights sensitivity labels and formal authorization.

Source

IETF RFC 4949: Internet Security Glossary, Version 2

mandatory access control (MAC): A means of restricting access to objects based on the sensitivity of the information contained in the objects and the formal authorization (i.e., clearance) of subjects to access information of such sensitivity.

Adds clearance and sensitivity labeling context.

Source

Red Hat

SELinux provides a mechanism for supporting mandatory access control (MAC) in the Linux kernel.

Shows practical MAC implementation in Linux via SELinux.

Source

RELATED TERMS

Attribute-Based Access Control Access Control List Least Privilege SELinux Bell–LaPadula Model Biba Model IAM Policy Enforcement

COMPETING TERMS

Discretionary Access Control RBAC

RELATIONS

• Broader: Access Control

KNOWLEDGE AREAS

Data Security Infrastructure Software Engineering Data Management

TARGET AUDIENCE

Chief Information Security Officer Security Architect Cybersecurity Engineer IT Manager Application Administrator Data Engineer

EXTERNAL SOURCES

• Wikipedia - Mandatory access control
• NIST - Official MAC glossary definition
• Red Hat - SELinux MAC implementation guide
• FreeBSD Project - TrustedBSD MAC framework overview

TOP QUESTIONS

What distinguishes Mandatory Access Control from Discretionary Access Control?

MAC centralizes policy enforcement using labels and clearances; DAC allows resource owners to grant permissions. MAC reduces misconfiguration risks but can be less flexible.

Category: Distinction

Where is Mandatory Access Control most commonly applied?

High-assurance and regulated environments, including government systems, financial platforms, and Linux systems using SELinux or AppArmor.

Category: Example

What are common mistakes when implementing MAC?

Poorly planned labels and categories, insufficient policy testing, and inadequate documentation for operational teams lead to denial storms and service disruption.

Category: Mistakes

Why is MAC still relevant today?

It provides strong, non-bypassable controls needed for zero-trust and compliance, particularly where confidentiality and isolation are paramount.

Category: Relevancy

How does MAC relate to SELinux?

SELinux is a Linux kernel security module enforcing MAC policies, using contexts and types to constrain process and file interactions.

Category: Overview

What is a hot topic around MAC?

Combining MAC with container sandboxing and least privilege in Kubernetes and serverless environments to reduce lateral movement.

Category: Topic

What risks come with MAC adoption?

Operational complexity and misconfigured rules can block legitimate access. Strong change management and testing mitigate these risks.

Category: Risks

Is RBAC a replacement for MAC?

RBAC complements MAC by simplifying role assignments; MAC provides stricter, label-based control. Many systems combine both models.

Category: Opinion

How to get started with MAC policies?

Begin with reference policies (e.g., SELinux targeted), classify assets, define labels, test incrementally, and train operations teams.

Category: Requirements