Why SELinux is not part of DAC? [closed]

Question

Is it a simpler, more elegant, intuitive way to just extend DAC with 4 more groups to achieve basically the same multidimensional access functionality as SELinux, only beautiful, easy to configure and maintain?

Answer 1

I take it you are referring to Discretionary Access Controls (https://en.wikipedia.org/wiki/Discretionary_access_control) and you are wondering why the perceived security benefits of SELinux are not default in most Linux distributions.

There are several reasons.

• There is a standard for DAC, and SELinux isn't in it.
• Apples vs Oranges. SELinux is a type of Mandatory Access Control (MAC). Conflating it with DAC is a category error.
• SELinux is just one example of MAC, it isn't the standard.
• Threat modelling should be done to ensure the right tradeoff of complexity vs security.

There is a standard for Unix DAC

See the answer to a related earlier question https://unix.stackexchange.com/a/731556/305714

Summary: POSIX outlines what is expected from DAC in Unix-like operating systems. While few deployments have strict POSIX adherence, it's still an influential lingua franca.

Since POSIX does not mandate anything like SELinux, nothing like SELinux is widespread.

Apples vs Oranges. DAC != MAC.

There is a whole ecosystem of possible Access Controls. The "see also" section in the earlier linked DAC page on wikipedia shows many examples.

SELinux is an implementation of Mandatory Access Control. Asking why DAC does not use SELinux is to make a category error. It is like asking why RBAC doesn't use deep packet inspection, or why bicycles don't use concrete moorings.

Competing MAC implementations

In the MAC space, SELinux is just one example. It is famous, but there are many implementations and no consensus on what should be standard. Even if people agreed that MAC should be more widespread, there would be disagreement around whether it should be SELinux, AppArmor, TOMOYO, or something else.

Complexity vs Security Tradeoffs

There is no such thing as secure computing. You can make security arbitrarily complex. If you want your gaming machine at home to be "secure", you should turn it off, melt it down in a vat of acid, and drop the vat of acid into a volcano.

Why don't people do this? Because when assessing what security measures are reasonable, they need to be proportional to the risks. The rate of compromise, and the cost per compromise.

This is done through threat modelling. You analyse a system's attack surfaces, the likely resources and intentions of threat actors, and the value of resources such as data or compute power on the system.

If the cost of maintaining a complex system is greater than the cost of compromize, and if the complexity is due to implementing security against threats which are unlikely to be a real problem for the deployment, it's not only reasonable to relax the security a bit in return for simpler administration, but in fact it would be economically irrational to do anything else.

These trade-offs are different for everyone, and in contexts where you're a nation-state actor engaged in a cyberwar with other nation-state level threats, you might decide that the risks and costs of compromise are too great and you need to use something like SELinux to safeguard national security and so on.

But for Mom & Pop Linux users who just want to play Elden Ring and surf reddit, there is no need to burden them with the complexity of MAC, they can just harden their IPTables configuration and avoid running commands like curl http://some.cool.scripts | sudo bash.