I need some clarification/confirmation/elaboration on the different roles DAC, ACL and MAC play in Linux file security.
After some research from the documentation, this is my understanding of the stack:
- SELinux must allow you access to the file object.
- If the file's ACLs (e.g.,
getfaclfor an ACL mount) explicitly allows/denies access to the object, then no further processing is required.
- Otherwise, it is up to the file's permissions (rwxrwxrwx DAC model).
Am I missing something? Are there situations where this is not the case?