What is Mandatory Access Control, and why is it better than Discretionary Access Control?

  • This question seems pretty subjective, MAC isn't "better" it's simply describing how access control is implemented – Jim B Jun 21 '09 at 3:53

Basically, it comes down to users being able to override the access controls at their discretion. In a MAC-based system, the policy cannot be overriden by a user to allow less privileged users access to a resource. The MAC is mandatory.

In some situations, it may be necessary to have this behaviour. Typically, I've heard of MACs used in highly secure operating systems that are used in military and highly secure government installations. Until recently, no "business grade" or "consumer grade" operating system really supported MACs. Windows Vista (with the "integrity level" functionality) and SELinux both are forms of MAC.


Mandatory access control : The Access control system only allows users who have already been given a clearance level to access the resource they intend to . But how do they grant access ? This is where Levels come into action . In the further discussions , users will be addressed as Subjects and the resources would be addressed as Objects . Each object and subject in that domain is given a "Security Level " .

Time for an example :- Assume there are three security levels . A ,B ,C . Security level of A is the highest . Security level of B is lower than A . Security eve of C is lower than B . A>B>C . Now Subjects having level A will be able to access only the objects having security levels less than A . Now Subjects having level B will be able to access only the objects having security levels less than B . Now Subjects having level C will be able to access only the objects having security levels less than C Assume Natasha has security level B . Now assume files under /var have level A and files under /etc/ have level C . As per the rule I mentioned , Natasha will be able to access only files under /etc which have levels lower than her level .

Discretionary access control is downright simple . When you create a file , you are the owner of that file . And in Discretionary access control , the owners of the files have their OWN "discretion" as to select the users to which access can be given and not given .

***P.S . The superuser can change the ownership of your file . So you are the owner of the file only if the superuser has not changed the ownership to someone else***

And answering your second question . MAC is more secure in big companies because the whole security of the company lies in the hands of the owner of the file if they implement DAC . What if the owner decides to grant access to people to whom the access shouldn't be given . So in the case of MAC the decision is in the hands of the Architects and they make sure the file goes to the right hands .


In discretionary access control permissions are set usually by the resource owner. In mandatory access control permissions are set by fixed rules based on policies and cannot be overridden by users.

Although mandatory is believed to be more secure and is used in places where high-security is desired, it is harder to configure and maintain and you may not have the resources to do it.

Other than that, several operating systems are incorporating mandatory access controls to further harden the system.


DAC: In discretionary access control (DAC), the owner of the object specifies which subjects can access the object. Most operating systems such as all Windows, Linux, and Macintosh and most flavors of Unix are based on DAC models.

In these operating systems, when you create a file, you decide what access privileges you want to give to other users; when they access your file, the operating system will make the access control decision based on the access privileges you created. MAC: In mandatory access control (MAC), the system (and not the users) specifies which subjects can access specific data objects.

The MAC model is based on security labels. Subjects are given a security clearance (secret, top secret, confidential, etc.), and data objects are given a security classification (secret, top secret, confidential, etc.). The clearance and classification data are stored in the security labels, which are bound to the specific subjects and objects.

When the system is making an access control decision, it tries to match the clearance of the subject with the classification of the object. For example, if a user has a security clearance of secret, and he requests a data object with a security classification of top secret, then the user will be denied access because his clearance is lower than the classification of the object.

The MAC model is usually used in environments where confidentiality is of utmost importance, such as a military institution.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy