Discretionary and mandatory access control

DAC lets the owner decide, which is flexible but unchecked

In the earliest computers, whoever had physical access controlled all of it. Multi-user systems inherited that model in a softer form: an administrator starts in supervisor mode and decides which less-privileged accounts to hand out, for tasks like running an app from a company they don’t fully trust or giving someone remote logon.

Every object, a file, a process, anything access control governs, is owned by some subject. Under discretionary access control (DAC), access to an object is decided by the identity of the subject that owns it, and that owner can pass their privileges on to other subjects at their own discretion, unless something else constrains them. Control sits with whoever owns the resource, who can grant or revoke it as they see fit.

The weakness is that nothing central checks those grants. A single careless or compromised owner can propagate access far beyond what the resource’s original purpose called for, and the DAC model itself does not stop them.

MAC removes the owner’s discretion, and even root is bound

Some organisations cannot tolerate any single person, administrator included, being able to override a classification rule. Mandatory access control (MAC) removes that discretion. An external entity, a security policy administrator, defines the access policy, and a security kernel checks a subject’s security attributes against an object’s before allowing any interaction. The owner of an object under MAC does not get the final say.

MAC grew out of a US military research program in the 1970s aimed at protecting classified information: a file marked Top Secret must never reach a user cleared only to Secret, regardless of what any ordinary user, or even the supervisor, tries to do. In a multilevel secure (MLS) system built this way, the administrator is no longer the boss. Ultimate control rests with a remote authority that sets policy, and root itself is under that authority’s control. That guarantee has to hold whatever any individual does, which is why the requirement needed MAC rather than a stronger version of DAC.

Compare

DAC

Access decided by the object’s owner. Owners can transfer their own privileges to other subjects at their own discretion. High flexibility, low central control.

MAC

Access decided by an external security policy administrator and enforced by a security kernel that checks security attributes. No individual subject, not even root, can override the policy. High rigour, low individual discretion.

Pitfall

Do not write that MAC gives the system administrator more power than DAC does. MAC does the opposite: it takes the final decision away from the administrator and root, and hands it to an external policy authority enforced by the security kernel. “Mandatory” describes who is bound by the policy, not who benefits from more control.

Real systems sit between the two, as OneDrive shows

Exam detail

The lecture’s worked contrast is Microsoft OneDrive. DAC: the creator of a file or folder is its owner by default and can transfer that ownership. Files are private unless the owner chooses otherwise: they can share with specific people by email, generate a link for viewing or editing, or make a file fully public, and set the permission level to view or edit. MAC: in Microsoft 365, the enterprise tier, administrators set organisation-wide sharing and access policies (for example restricting sharing to specific domains), and Data Loss Prevention (DLP) rules automatically restrict access to information the policy marks sensitive. An individual file owner cannot override either. OneDrive uses DAC for personal accounts and layers MAC on top for enterprise control, which is why the lecture frames DAC and MAC as two ends of a spectrum rather than an either-or choice.

Recall

A start-up has no access-control policy beyond letting each employee decide who can see the files they create. Which model is this, and what happens to a file if its creator does nothing?

This is discretionary access control. If the creator sets no explicit sharing rule, the file is accessible to everyone in the company by default, exactly as the practice-quiz scenario describes for Sam’s start-up.

Optional aside

Bell-LaPadula and Biba, covered later in this module, are the two named security policy models that formalise MAC’s “no override” guarantee into precise rules about what a subject may read and write. This page only introduces the spectrum; the formal properties come with those two models.