- [Instructor] Mandatory access control systems
are the most stringent type of access control.
In mandatory access control, or MAC systems,
the operating system itself restricts the permissions
that may be granted to users and processes
on system resources.
Users themselves cannot modify permissions.
For this reason, MAC is rarely fully implemented
on production systems outside of highly secure environments.
MAC is normally implemented
as a rule-based access control system
where users and resources have labels
and the operating system makes access control decisions
by comparing those labels.
The most common example of an operating system
implementing MAC is Security-Enhanced Linux, or SELinux,
a Linux kernel security module developed
by the U.S. National Security Agency in the 1990s
and included in some Linux distributions,
including Red Hat Enterprise Linux, CentOS, and Fedora.
So let's take a look at a brief demonstration.
I have here an SSH session open
to a Linux system running Red Hat Enterprise Linux
with the SELinux kernel module installed and running.
I'll show you how SELinux enforces separation
between processes.
First, let's confirm that SELinux is enabled.
I can do that using the getenforce command.
As you can see, the system simply responded
with the word Enforcing,
telling us that it is currently running in MAC mode.
The other options the system might have responded with
include permissive, which would mean
that the system is evaluating policies
but not enforcing them, only providing warning messages,
or disabled, which would mean
that SELinux is turned off completely.
Configuring SELinux is pretty complex,
but I'd just like to show you a few things.
Every resource controlled
by SELinux has a type assigned to it,
and we can see that information
by using the Z flag attached to various Linux commands.
For example, let's take a look at the processes running
on the system by using the ps command
with the Z flag added to the end.
If you look at the output,
you'll notice that there is a new field at the beginning
that you don't normally see in process listings.
This is the SELinux information.
I'll focus on one piece buried within that field, the type.
That's the third section of the field that ends in _t.
For example, you can see here that the SSH daemon
runs with a type of sshd_t.
The Apache HTTPd daemon
runs using the httpd type.
Files also have types.
Let's go take a look at the var/www/html directory
where Apache stores web content.
If we take a look at the contents of this directory
using the ls command with the Z flag,
we see that the files contained here
also have an httpd type.
Because the httpd process shares that common characteristic,
the process can access these files.
However, if we go take a look at a user's home directory
and list the file contents there,
notice that these files have a user type.
The httpd process would not be able to read them,
and there is no change that the user can make
to allow this access.
It is enforced by the operating system.
That's mandatory access control.