Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I need some clarification/confirmation/elaboration on the different roles DAC, ACL and MAC play in Linux file security.

After some research from the documentation, this is my understanding of the stack:

  1. SELinux must allow you access to the file object.
  2. If the file's ACLs (e.g., setfacl, getfacl for an ACL mount) explicitly allows/denies access to the object, then no further processing is required.
  3. Otherwise, it is up to the file's permissions (rwxrwxrwx DAC model).

Am I missing something? Are there situations where this is not the case?

share|improve this question
I think that you are correct. Could you post the problem that you are having? –  Kevin M Jul 17 '11 at 14:43
I apologize for the malformed question. I feel like, when it comes to this, I go into a "trial and error" mode. I am trying to confidently grasp it and was hoping someone could share a clearer picture of the roles played by each portion of the stack. –  Beaming Mel-Bin Jul 17 '11 at 19:14
Edited the question to clarify what I'm looking for in answers. –  Beaming Mel-Bin Jul 17 '11 at 19:17
add comment

2 Answers

up vote 5 down vote accepted

DAC == Discretionary Access Control, http://en.wikipedia.org/wiki/Discretionary_access_control
MAC == Mandatory Access Control, http://en.wikipedia.org/wiki/Mandatory_access_control
ACL == Access Control List, http://en.wikipedia.org/wiki/Access_control_list

The ACL specifies the controls to be applied by the method of control, DAC or MAC. MAC is explicit, centrally controlled, and does not allow users to grant authority to an object unless they have explicit permissions to do so, whereas DAC allows users to grant other users access to objects they can access.

MAC ACLs will always be applied to a request first, and if access is denied processing stops. If access is permitted then the DAC ACLs are applied, and again if access is denied processing stops. Only if access is granted by both MAC and DAC ACLs can the user access the object they requested.

SELinux is a MAC implementation for Linux (there are others), while the traditional rwx file permissions, combined with the owning user and group form the complete DAC ACL. The SELinux 'policy' is essentially the MAC ACL.

share|improve this answer
Where do file ACL's (e.g., setfacl) come in? –  Beaming Mel-Bin Jul 18 '11 at 0:30
setacl extends the basic filesystem ACLs to allow more than a single user or group to be assigned an to ACL for files and directories. This is also a DAC implementation, and is therefore applied after the SELinux MAC ACLs. –  Mike Insch Jul 18 '11 at 8:33
Thanks Mike. One more question: As far as I can tell via my testing, the explicitly set setfacl ACLs override the traditional permissions. Is this true in every case? –  Beaming Mel-Bin Jul 18 '11 at 13:30
As far as I know, yes, the setacl / setfacl ACLs will override the traditional 'simple' ACL on the file. –  Mike Insch Jul 18 '11 at 14:54
add comment

Sorry to quibble, but I think some of the answers here might be incorrect. Directly from Fedora's http://docs.fedoraproject.org/en-US/Fedora/13/html/Security-Enhanced_Linux/sect-Security-Enhanced_Linux-Working_with_SELinux-SELinux_Contexts_Labeling_Files.html:

SELinux policy rules are checked after DAC rules. SELinux policy rules are not used if DAC rules deny access first.

share|improve this answer
add comment

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.