In computer security, mandatory access control (MAC) refers to a type of access control by which the operating system or database constrains the ability of a subject or initiator to access or generally perform some sort of operation on an object or target.[1] In the case of operating systems, a subject is usually a process or thread; objects are constructs such as files, directories, TCP/UDP ports, shared memory segments, IO devices, etc. Subjects and objects each have a set of security attributes. Whenever a subject attempts to access an object, an authorization rule enforced by the operating system kernel examines these security attributes and decides whether the access can take place. Any operation by any subject on any object is tested against the set of authorization rules (aka policy) to determine if the operation is allowed. A database management system, in its access control mechanism, can also apply mandatory access control; in this case, the objects are tables, views, procedures, etc.
With mandatory access control, this security policy is centrally controlled by a security policy administrator; users do not have the ability to override the policy and, for example, grant access to files that would otherwise be restricted. By contrast, discretionary access control (DAC), which also governs the ability of subjects to access objects, allows users the ability to make policy decisions and/or assign security attributes. (The traditional Unix system of users, groups, and read-write-execute permissions is an example of DAC.) MAC-enabled systems allow policy administrators to implement organization-wide security policies. Under MAC (and unlike DAC), users cannot override or modify this policy, either accidentally or intentionally. This allows security administrators to define a central policy that is guaranteed (in principle) to be enforced for all users.
Historically and traditionally, MAC has been closely associated with multilevel security (MLS) and specialized military systems. In this context, MAC implies a high degree of rigor to satisfy the constraints of MLS systems. More recently, however, MAC has deviated out of the MLS niche and has started to become more mainstream. The more recent MAC implementations, such as SELinux and AppArmor for Linux and Mandatory Integrity Control for Windows, allow administrators to focus on issues such as network attacks and malware without the rigor or constraints of MLS.
Historical background and implications for multilevel security
Historically, MAC was strongly associated with multilevel security (MLS) as a means of protecting US classified information. The Trusted Computer System Evaluation Criteria (TCSEC), the seminal work on the subject, provided the original definition of MAC as "a means of restricting access to objects based on the sensitivity (as represented by a label) of the information contained in the objects and the formal authorization (i.e., clearance) of subjects to access information of such sensitivity".[2] Early implementations of MAC such as Honeywell's SCOMP, USAF SACDIN, NSA Blacker, and Boeing's MLS LAN focused on MLS to protect military-oriented security classification levels with robust enforcement.
The term mandatory in MAC has acquired a special meaning derived from its use with military systems. In this context, MAC implies an extremely high degree of robustness that assures that the control mechanisms can resist any type of subversion, thereby enabling them to enforce access controls that are mandated by order of a government such as the Executive Order 12958 for US classified information. Enforcement is supposed to be more imperative than for commercial applications. This precludes enforcement by best-effort mechanisms; only mechanisms that can provide absolute or near-absolute enforcement of the mandate are acceptable for MAC. This is a tall order and sometimes assumed unrealistic by those unfamiliar with high assurance strategies, and very difficult for those who are.
Strength
Degrees
In some systems, users have the authority to decide whether to grant access to any other user. To allow that, all users have clearances for all data. This is not necessarily true of an MLS system. If individuals or processes exist that may be denied access to any of the data in the system environment, then the system must be trusted to enforce MAC. Since there can be various levels of data classification and user clearances, this implies a quantified scale for robustness. For example, more robustness is indicated for system environments containing classified Top Secret information and uncleared users than for one with Secret information and users cleared to at least Confidential. To promote consistency and eliminate subjectivity in degrees of robustness, an extensive scientific analysis and risk assessment of the topic produced a landmark benchmark standardization quantifying security robustness capabilities of systems and mapping them to the degrees of trust warranted for various security environments. The result was documented in CSC-STD-004-85.[3] Two relatively independent components of robustness were defined: Assurance Level and Functionality. Both were specified with a degree of precision that warranted significant confidence in certifications based on these criteria.
Evaluation
The Common Criteria[4] is based on this science and it intended to preserve the Assurance Level as EAL levels and the functionality specifications as Protection Profiles. Of these two essential components of objective robustness benchmarks, only EAL levels were faithfully preserved. In one case, TCSEC level C2[5] (not a MAC capable category) was fairly faithfully preserved in the Common Criteria, as the Controlled Access Protection Profile (CAPP).[6]Multilevel security (MLS) Protection Profiles (such as MLSOSPP similar to B2)[7] is more general than B2. They are pursuant to MLS, but lack the detailed implementation requirements of their Orange Book predecessors, focusing more on objectives. This gives certifiers more subjective flexibility in deciding whether the evaluated product’s technical features adequately achieve the objective, potentially eroding consistency of evaluated products and making it easier to attain certification for less trustworthy products. For these reasons, the importance of the technical details of the Protection Profile is critical to determining the suitability of a product.
Such an architecture prevents an authenticated user or process at a specific classification or trust-level from accessing information, processes, or devices in a different level. This provides a containment mechanism of users and processes, both known and unknown (an unknown program (for example) might comprise an untrusted application where the system should monitor and/or control accesses to devices and files).
Implementations
This article is in list format but may read better as prose. You can help by converting this article, if appropriate. Editing help is available.(January 2018)
A few MAC implementations, such as Unisys' Blacker project, were certified robust enough to separate Top Secret from Unclassified late in the last millennium. Their underlying technology became obsolete and they were not refreshed. Today there are no current implementations certified by TCSEC to that level of robust implementation. However, some less robust products exist.
Amon Ott's RSBAC (Rule Set Based Access Control) provides a framework for Linux kernels that allows several different security policy / decision modules. One of the models implemented is Mandatory Access Control model. A general goal of RSBAC design was to try to reach (obsolete) Orange Book (TCSEC) B1 level. The model of mandatory access control used in RSBAC is mostly the same as in Unix System V/MLS, Version 1.2.1 (developed in 1989 by the National Computer Security Center of the USA with classification B1/TCSEC). RSBAC requires a set of patches to the stock kernel, which are maintained quite well by the project owner.
TOMOYO Linux is a lightweight MAC implementation for Linux and Embedded Linux, developed by NTT Data Corporation. It has been merged in Linux Kernel mainline version 2.6.30 in June 2009.[8] Differently from the label-based approach used by SELinux, TOMOYO Linux performs a pathname-basedMandatory Access Control, separating security domains according to process invocation history, which describes the system behavior. Policy are described in terms of pathnames. A security domain is simply defined by a process call chain, and represented by a string. There are 4 modes: disabled, learning, permissive, enforcing. Administrators can assign different modes for different domains. TOMOYO Linux introduced the "learning" mode, in which the accesses occurred in the kernel are automatically analyzed and stored to generate MAC policy: this mode could then be the first step of policy writing, making it easy to customize later.
SUSE Linux and Ubuntu 7.10 have added a MAC implementation called AppArmor. AppArmor utilizes a Linux 2.6 kernel feature called LSM (Linux Security Modules interface). LSM provides a kernel API that allows modules of kernel code to govern ACL (DAC ACL, access-control lists). AppArmor is not capable of restricting all programs and is optionally in the Linux kernel as of version 2.6.36.[9]
Linux and many other Unix distributions have MAC for CPU (multi-ring), disk, and memory; while OS software may not manage privileges well, Linux became famous during the 1990s as being more secure and far more stable than non-Unix alternatives. Linux distributors disable MAC to being at best DAC for some devices – although this is true for any consumer electronics available today.
Android since its 5.0 release has used SELinux to enforce a MAC security model on top of its original UID-based DAC approach.[10]
grsecurity is a patch for the Linux kernel providing a MAC implementation (precisely, it is an RBAC implementation). grsecurity is not implemented via the LSM API.[11]
Microsoft Starting with Windows Vista and Server 2008 Windows incorporates Mandatory Integrity Control, which adds Integrity Levels (IL) to processes running in a login session. MIC restricts the access permissions of applications that are running under the same user account and which may be less trustworthy. Five integrity levels are defined: Low, Medium, High, System, and Trusted Installer.[12] Processes started by a regular user gain a Medium IL; elevated processes have High IL.[13] While processes inherit the integrity level of the process that spawned it, the integrity level can be customized on a per-process basis: e.g. IE7 and downloaded executables run with Low IL. Windows controls access to objects based on ILs, as well as for defining the boundary for window messages via User Interface Privilege Isolation. Named objects, including files, registry keys or other processes and threads, have an entry in the ACL governing access to them that defines the minimum IL of the process that can use the object. MIC enforces that a process can write to or delete an object only when its IL is equal to or higher than the object’s IL. Furthermore, to prevent access to sensitive data in memory, processes can’t open processes with a higher IL for read access.[14]
FreeBSD supports Mandatory Access Control, implemented as part of the TrustedBSD project. It was introduced in FreeBSD 5.0. Since FreeBSD 7.2, MAC support is enabled by default. The framework is extensible; various MAC modules implement policies such as Biba and multilevel security.
Sun's Trusted Solaris uses a mandatory and system-enforced access control mechanism (MAC), where clearances and labels are used to enforce a security policy. However note that the capability to manage labels does not imply the kernel strength to operate in multilevel security mode[citation needed]. Access to the labels and control mechanisms are not[citation needed] robustly protected from corruption in protected domain maintained by a kernel. The applications a user runs are combined with the security label at which the user works in the session. Access to information, programs and devices are only weakly controlled[citation needed].
Apple's Mac OS X MAC framework is an implementation of the TrustedBSD MAC framework.[15] A limited high-level sandboxing interface is provided by the command-line function sandbox_init. See the sandbox_init manual page for documentation.[16]
Oracle Label Security is an implementation of mandatory access control in the Oracle DBMS.
SE-PostgreSQL is a work in progress as of 2008-01-27,[17][18] providing integration into SE-Linux. It aims for integration into version 8.4, together with row-level restrictions.
Trusted RUBIX is a mandatory access control enforcing DBMS that fully integrates with SE-Linux to restrict access to all database objects.[19]
Smack (Simplified Mandatory Access Control Kernel) is a Linux kernelsecurity module that protects data and process interaction from malicious manipulation using a set of custom mandatory access control rules, with simplicity as its main design goal.[21] It has been officially merged since the Linux 2.6.25 release.[22]
ZeroMAC written by Peter Gabor Gyulay is a Linux LSM kernel patch.[23]
^Belim, S. V.; Belim, S. Yu. (December 2018). "Implementation of Mandatory Access Control in Distributed Systems". Automatic Control and Computer Sciences. 52 (8): 1124–1126. doi:10.3103/S0146411618080357. ISSN 0146-4116. S2CID 73725128.
^. 1985-06-25. Archived from the original on July 15, 2007. Retrieved 2008-03-15.
^. Archived from the original on 2006-07-18. Retrieved 2008-03-15.
^US Department of Defense (December 1985). "DoD 5200.28-STD: Trusted Computer System Evaluation Criteria". Retrieved 2008-03-15.
^. National Security Agency. 1999-10-08. Archived from the original on 2012-02-07. Retrieved 2008-03-15.
^"Protection Profile for Multi-Level Operating Systems in Environments Requiring Medium Robustness, Version 1.22" (PDF). National Security Agency. 2001-05-23. Retrieved 2018-10-06.
^"TOMOYO Linux, an alternative Mandatory Access Control". Linux 2 6 30. Linux Kernel Newbies.
^"Linux 2.6.36 released 20 October 2010". Linux 2.6.36. Linux Kernel Newbies.
^"Security-Enhanced Linux in Android". Android Open Source Project.
P. A. Loscocco, S. D. Smalley, P. A. Muckelbauer, R. C. Taylor, S. J. Turner, and J. F. Farrell. . In Proceedings of the 21st National Information Systems Security Conference, pages 303–314, Oct. 1998.
P. A. Loscocco, S. D. Smalley, Meeting Critical Security Objectives with Security-Enhanced Linux Proceedings of the 2001 Ottawa Linux Symposium.
ISO/IEC DIS 10181-3, Information Technology, OSI Security Model, Security FrameWorks, Part 3: Access Control, 1993
Robert N. M. Watson. "A decade of OS access-control extensibility". Commun. ACM 56, 2 (February 2013), 52–63.
External links
on the how virtualization can be used to implement Mandatory Access Control.
Weblog post from a Microsoft employee detailing Mandatory Integrity Control and how it differs from MAC implementations.
GWV Formal Security Policy Model A Separation Kernel Formal Security Policy, David Greve, Matthew Wilding, and W. Mark Vanfleet.
January 11, 2023
mandatory, access, control, confused, with, message, authentication, code, this, article, needs, additional, citations, verification, please, help, improve, this, article, adding, citations, reliable, sources, unsourced, material, challenged, removed, find, so. Not to be confused with Message authentication code This article needs additional citations for verification Please help improve this article by adding citations to reliable sources Unsourced material may be challenged and removed Find sources Mandatory access control news newspapers books scholar JSTOR January 2018 Learn how and when to remove this template message In computer security mandatory access control MAC refers to a type of access control by which the operating system or database constrains the ability of a subject or initiator to access or generally perform some sort of operation on an object or target 1 In the case of operating systems a subject is usually a process or thread objects are constructs such as files directories TCP UDP ports shared memory segments IO devices etc Subjects and objects each have a set of security attributes Whenever a subject attempts to access an object an authorization rule enforced by the operating system kernel examines these security attributes and decides whether the access can take place Any operation by any subject on any object is tested against the set of authorization rules aka policy to determine if the operation is allowed A database management system in its access control mechanism can also apply mandatory access control in this case the objects are tables views procedures etc With mandatory access control this security policy is centrally controlled by a security policy administrator users do not have the ability to override the policy and for example grant access to files that would otherwise be restricted By contrast discretionary access control DAC which also governs the ability of subjects to access objects allows users the ability to make policy decisions and or assign security attributes The traditional Unix system of users groups and read write execute permissions is an example of DAC MAC enabled systems allow policy administrators to implement organization wide security policies Under MAC and unlike DAC users cannot override or modify this policy either accidentally or intentionally This allows security administrators to define a central policy that is guaranteed in principle to be enforced for all users Historically and traditionally MAC has been closely associated with multilevel security MLS and specialized military systems In this context MAC implies a high degree of rigor to satisfy the constraints of MLS systems More recently however MAC has deviated out of the MLS niche and has started to become more mainstream The more recent MAC implementations such as SELinux and AppArmor for Linux and Mandatory Integrity Control for Windows allow administrators to focus on issues such as network attacks and malware without the rigor or constraints of MLS Contents 1 Historical background and implications for multilevel security 2 Strength 2 1 Degrees 2 2 Evaluation 3 Implementations 4 See also 5 Footnotes 6 References 7 External linksHistorical background and implications for multilevel security EditHistorically MAC was strongly associated with multilevel security MLS as a means of protecting US classified information The Trusted Computer System Evaluation Criteria TCSEC the seminal work on the subject provided the original definition of MAC as a means of restricting access to objects based on the sensitivity as represented by a label of the information contained in the objects and the formal authorization i e clearance of subjects to access information of such sensitivity 2 Early implementations of MAC such as Honeywell s SCOMP USAF SACDIN NSA Blacker and Boeing s MLS LAN focused on MLS to protect military oriented security classification levels with robust enforcement The term mandatory in MAC has acquired a special meaning derived from its use with military systems In this context MAC implies an extremely high degree of robustness that assures that the control mechanisms can resist any type of subversion thereby enabling them to enforce access controls that are mandated by order of a government such as the Executive Order 12958 for US classified information Enforcement is supposed to be more imperative than for commercial applications This precludes enforcement by best effort mechanisms only mechanisms that can provide absolute or near absolute enforcement of the mandate are acceptable for MAC This is a tall order and sometimes assumed unrealistic by those unfamiliar with high assurance strategies and very difficult for those who are Strength EditDegrees Edit In some systems users have the authority to decide whether to grant access to any other user To allow that all users have clearances for all data This is not necessarily true of an MLS system If individuals or processes exist that may be denied access to any of the data in the system environment then the system must be trusted to enforce MAC Since there can be various levels of data classification and user clearances this implies a quantified scale for robustness For example more robustness is indicated for system environments containing classified Top Secret information and uncleared users than for one with Secret information and users cleared to at least Confidential To promote consistency and eliminate subjectivity in degrees of robustness an extensive scientific analysis and risk assessment of the topic produced a landmark benchmark standardization quantifying security robustness capabilities of systems and mapping them to the degrees of trust warranted for various security environments The result was documented in CSC STD 004 85 3 Two relatively independent components of robustness were defined Assurance Level and Functionality Both were specified with a degree of precision that warranted significant confidence in certifications based on these criteria Evaluation Edit The Common Criteria 4 is based on this science and it intended to preserve the Assurance Level as EAL levels and the functionality specifications as Protection Profiles Of these two essential components of objective robustness benchmarks only EAL levels were faithfully preserved In one case TCSEC level C2 5 not a MAC capable category was fairly faithfully preserved in the Common Criteria as the Controlled Access Protection Profile CAPP 6 Multilevel security MLS Protection Profiles such as MLSOSPP similar to B2 7 is more general than B2 They are pursuant to MLS but lack the detailed implementation requirements of their Orange Book predecessors focusing more on objectives This gives certifiers more subjective flexibility in deciding whether the evaluated product s technical features adequately achieve the objective potentially eroding consistency of evaluated products and making it easier to attain certification for less trustworthy products For these reasons the importance of the technical details of the Protection Profile is critical to determining the suitability of a product Such an architecture prevents an authenticated user or process at a specific classification or trust level from accessing information processes or devices in a different level This provides a containment mechanism of users and processes both known and unknown an unknown program for example might comprise an untrusted application where the system should monitor and or control accesses to devices and files Implementations EditThis article is in list format but may read better as prose You can help by converting this article if appropriate Editing help is available January 2018 This article may contain indiscriminate excessive or irrelevant examples Please improve the article by adding more descriptive text and removing less pertinent examples See Wikipedia s guide to writing better articles for further suggestions January 2018 A few MAC implementations such as Unisys Blacker project were certified robust enough to separate Top Secret from Unclassified late in the last millennium Their underlying technology became obsolete and they were not refreshed Today there are no current implementations certified by TCSEC to that level of robust implementation However some less robust products exist Amon Ott s RSBAC Rule Set Based Access Control provides a framework for Linux kernels that allows several different security policy decision modules One of the models implemented is Mandatory Access Control model A general goal of RSBAC design was to try to reach obsolete Orange Book TCSEC B1 level The model of mandatory access control used in RSBAC is mostly the same as in Unix System V MLS Version 1 2 1 developed in 1989 by the National Computer Security Center of the USA with classification B1 TCSEC RSBAC requires a set of patches to the stock kernel which are maintained quite well by the project owner TOMOYO Linux is a lightweight MAC implementation for Linux and Embedded Linux developed by NTT Data Corporation It has been merged in Linux Kernel mainline version 2 6 30 in June 2009 8 Differently from the label based approach used by SELinux TOMOYO Linux performs a pathname based Mandatory Access Control separating security domains according to process invocation history which describes the system behavior Policy are described in terms of pathnames A security domain is simply defined by a process call chain and represented by a string There are 4 modes disabled learning permissive enforcing Administrators can assign different modes for different domains TOMOYO Linux introduced the learning mode in which the accesses occurred in the kernel are automatically analyzed and stored to generate MAC policy this mode could then be the first step of policy writing making it easy to customize later SUSE Linux and Ubuntu 7 10 have added a MAC implementation called AppArmor AppArmor utilizes a Linux 2 6 kernel feature called LSM Linux Security Modules interface LSM provides a kernel API that allows modules of kernel code to govern ACL DAC ACL access control lists AppArmor is not capable of restricting all programs and is optionally in the Linux kernel as of version 2 6 36 9 Linux and many other Unix distributions have MAC for CPU multi ring disk and memory while OS software may not manage privileges well Linux became famous during the 1990s as being more secure and far more stable than non Unix alternatives Linux distributors disable MAC to being at best DAC for some devices although this is true for any consumer electronics available today Android since its 5 0 release has used SELinux to enforce a MAC security model on top of its original UID based DAC approach 10 grsecurity is a patch for the Linux kernel providing a MAC implementation precisely it is an RBAC implementation grsecurity is not implemented via the LSM API 11 Microsoft Starting with Windows Vista and Server 2008 Windows incorporates Mandatory Integrity Control which adds Integrity Levels IL to processes running in a login session MIC restricts the access permissions of applications that are running under the same user account and which may be less trustworthy Five integrity levels are defined Low Medium High System and Trusted Installer 12 Processes started by a regular user gain a Medium IL elevated processes have High IL 13 While processes inherit the integrity level of the process that spawned it the integrity level can be customized on a per process basis e g IE7 and downloaded executables run with Low IL Windows controls access to objects based on ILs as well as for defining the boundary for window messages via User Interface Privilege Isolation Named objects including files registry keys or other processes and threads have an entry in the ACL governing access to them that defines the minimum IL of the process that can use the object MIC enforces that a process can write to or delete an object only when its IL is equal to or higher than the object s IL Furthermore to prevent access to sensitive data in memory processes can t open processes with a higher IL for read access 14 FreeBSD supports Mandatory Access Control implemented as part of the TrustedBSD project It was introduced in FreeBSD 5 0 Since FreeBSD 7 2 MAC support is enabled by default The framework is extensible various MAC modules implement policies such as Biba and multilevel security Sun s Trusted Solaris uses a mandatory and system enforced access control mechanism MAC where clearances and labels are used to enforce a security policy However note that the capability to manage labels does not imply the kernel strength to operate in multilevel security mode citation needed Access to the labels and control mechanisms are not citation needed robustly protected from corruption in protected domain maintained by a kernel The applications a user runs are combined with the security label at which the user works in the session Access to information programs and devices are only weakly controlled citation needed Apple s Mac OS X MAC framework is an implementation of the TrustedBSD MAC framework 15 A limited high level sandboxing interface is provided by the command line function sandbox init See the sandbox init manual page for documentation 16 Oracle Label Security is an implementation of mandatory access control in the Oracle DBMS SE PostgreSQL is a work in progress as of 2008 01 27 17 18 providing integration into SE Linux It aims for integration into version 8 4 together with row level restrictions Trusted RUBIX is a mandatory access control enforcing DBMS that fully integrates with SE Linux to restrict access to all database objects 19 Astra Linux OS developed for Russian Army has its own mandatory access control 20 Smack Simplified Mandatory Access Control Kernel is a Linux kernel security module that protects data and process interaction from malicious manipulation using a set of custom mandatory access control rules with simplicity as its main design goal 21 It has been officially merged since the Linux 2 6 25 release 22 ZeroMAC written by Peter Gabor Gyulay is a Linux LSM kernel patch 23 See also EditBell LaPadula model Access control list Attribute based access control ABAC Context based access control CBAC Discretionary access control DAC Lattice based access control LBAC Organisation based access control OrBAC Role based access control RBAC Rule set based access control RSBAC Capability based security Location based authentication Risk based authentication Clark Wilson model Classified information Graham Denning model Mandatory Integrity Control Multiple single level Security modes Smack software Systrace Take grant protection model Type enforcementFootnotes Edit Belim S V Belim S Yu December 2018 Implementation of Mandatory Access Control in Distributed Systems Automatic Control and Computer Sciences 52 8 1124 1126 doi 10 3103 S0146411618080357 ISSN 0146 4116 S2CID 73725128 http csrc nist gov publications history dod85 pdf bare URL PDF Technical Rational Behind CSC STD 003 85 Computer Security Requirements 1985 06 25 Archived from the original on July 15 2007 Retrieved 2008 03 15 The Common Criteria Portal Archived from the original on 2006 07 18 Retrieved 2008 03 15 US Department of Defense December 1985 DoD 5200 28 STD Trusted Computer System Evaluation Criteria Retrieved 2008 03 15 Controlled Access Protection Profile Version 1 d National Security Agency 1999 10 08 Archived from the original on 2012 02 07 Retrieved 2008 03 15 Protection Profile for Multi Level Operating Systems in Environments Requiring Medium Robustness Version 1 22 PDF National Security Agency 2001 05 23 Retrieved 2018 10 06 TOMOYO Linux an alternative Mandatory Access Control Linux 2 6 30 Linux Kernel Newbies Linux 2 6 36 released 20 October 2010 Linux 2 6 36 Linux Kernel Newbies Security Enhanced Linux in Android Android Open Source Project Why doesn t grsecurity use LSM Matthew Conover Analysis of the Windows Vista Security Model Symantec Corporation Archived from the original on 2008 03 25 Retrieved 2007 10 08 Steve Riley Mandatory Integrity Control in Windows Vista Retrieved 2007 10 08 Mark Russinovich PsExec User Account Control and Security Boundaries Retrieved 2007 10 08 TrustedBSD Project TrustedBSD Mandatory Access Control MAC Framework Retrieved 2008 03 15 sandbox init 3 man page 2007 07 07 Retrieved 2008 03 15 SEPostgreSQL patch Security Enhanced PostgreSQL Trusted RUBIX Archived from the original on 2008 11 21 Retrieved 2020 03 23 in Russian Klyuchevye osobennosti Astra Linux Special Edition po realizacii trebovanij bezopasnosti informacii Archived 2014 07 16 at the Wayback Machine Official SMACK documentation from the Linux source tree Archived from the original on 2013 05 01 Jonathan Corbet More stuff for 2 6 25 Archived from the original on 2012 11 02 zeromac uk References EditP A Loscocco S D Smalley P A Muckelbauer R C Taylor S J Turner and J F Farrell The Inevitability of Failure The Flawed Assumption of Security in Modern Computing Environments In Proceedings of the 21st National Information Systems Security Conference pages 303 314 Oct 1998 P A Loscocco S D Smalley Meeting Critical Security Objectives with Security Enhanced Linux Proceedings of the 2001 Ottawa Linux Symposium ISO IEC DIS 10181 3 Information Technology OSI Security Model Security FrameWorks Part 3 Access Control 1993 Robert N M Watson A decade of OS access control extensibility Commun ACM 56 2 February 2013 52 63 External links EditWeblog post on the how virtualization can be used to implement Mandatory Access Control Weblog post from a Microsoft employee detailing Mandatory Integrity Control and how it differs from MAC implementations GWV Formal Security Policy Model A Separation Kernel Formal Security Policy David Greve Matthew Wilding and W Mark Vanfleet Retrieved from https en wikipedia org w index php title Mandatory access control amp oldid 1117371527, wikipedia, wiki, book, books, library,
