Mandatory Access Control (MAC), refers to a set of access control policies that are
mandatorily enforced on users by the operating system. MAC policies may be contrasted
with Discretionary Access Control (DAC) protections, by which non-administrative users
may (at their discretion) protect objects. In traditional UNIX systems, DAC protections
include file permissions and access control lists; MAC protections include process
controls preventing inter-user debugging and firewalls. A variety of MAC policies have
been formulated by operating system designers and security researches, including the
Multi-Level Security (MLS) confidentiality policy, the Biba integrity policy, Role-Based
Access Control (RBAC), and Type Enforcement (TE). Each model bases decisions on a variety
of factors, including user identity, role, and security clearance, as well as security
labels on objects representing concepts such as data sensitivity and integrity.
The TrustedBSD MAC Framework is capable of supporting policy modules that implement
all of these policies, as well as a broad class of system hardening policies. In
addition, despite the name, the MAC Framework can also be used to implement purely
discretionary policies, as policy modules are given substantial flexibility in how they
authorize protections.
