What is mandatory access control?
Mandatory access control (MAC) is an access control model in which a central policy, not the owner of a file, decides who may use it. Each file or record carries a classification label, for example Top Secret, Secret or Confidential, and each user or process holds a clearance. On every request the system compares the two and allows only what the policy permits. Nobody can relabel data or share it outside the rules, including the person who created it. The term has nothing to do with MAC addresses, the hardware identifiers on network interfaces.
Labels, clearances and need-to-know
Holding a high enough clearance is not sufficient on its own. Labels usually also carry categories, sometimes called compartments, and a subject must be cleared for each category on an object as well as for its level. A Secret-cleared analyst on one program therefore can't open Secret material from another, which is need-to-know enforced by the system. Labels are assigned by security administrators under the classification policy, and changing one is itself a controlled, audited action.
Two formal models show what MAC can protect. Bell-LaPadula guards confidentiality: a subject may not read objects labeled above its clearance (no read up) or write into objects labeled below it (no write down), which stops secrets leaking downward. Biba guards integrity with the opposite pair: no reading from less trustworthy sources and no writing into more trusted data.
MAC on everyday systems
MAC isn't limited to government networks. SELinux, standard on Red Hat-family Linux distributions, tags processes and files with types and denies any access its policy doesn't explicitly allow, and root gets no exemption. A blocked attempt lands in the audit log as an AVC denial:
type=AVC msg=audit(1792561934.118:2207): avc: denied { read } for pid=4113 comm="httpd" name="shadow" scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:shadow_t:s0 tclass=file permissive=0
The web server process, running as httpd_t, was refused read access to a file of type shadow_t, whatever its ordinary permissions said. AppArmor, used on Ubuntu and SUSE, is another Linux MAC system, and Windows applies a narrower mandatory layer called integrity levels, which stops a low-integrity process, such as a sandboxed browser process, from writing to higher-integrity objects.
Strengths and costs
MAC gives the most predictable enforcement of the access control models. One careless owner can't widen access, and malware running under a user's account gains no power to relabel data. The price is rigidity and administrative effort. Every object needs a correct label and every subject a clearance, and a legitimate exception requires a policy change rather than a quick share. That is why full MAC is common in military and intelligence systems and used more narrowly, as with SELinux, elsewhere.
MAC vs. DAC vs. role-based access control
- Mandatory (MAC): the system decides from labels and clearances; owners can't override it.
- Discretionary (DAC): the owner decides who gets access.
- Role-based: administrators attach permissions to job roles and assign people to them.
Mandatory access control on the CompTIA Security+ exam
Mandatory access control is one of the six access control models in SY0-801 objective 4.5. Scenario words that point to it include labels, classification levels, clearances, a trusted operating system, or users who cannot change permissions even on files they created. The usual distractor is discretionary access control; ask who controls the decision, and if the owner has no say, it's MAC. Role-based access control is the other common trap, since clearances can look like job roles. A question describing SELinux in enforcing mode is also testing MAC.