InfoSec Notes
HubCybersecurity vs Information SecurityHistory of Information SecurityImportance of Information SecuritySecurity Principles and the CIA TriadWhat is Information Security?Accountability in Information SecurityAuthentication in Information SecurityAuthorization in Information SecurityAvailability in Information SecurityConfidentiality in Information SecurityIntegrity in Information SecurityNon-Repudiation in Information SecurityAES - Advanced Encryption StandardAsymmetric Key CryptographyDES - Data Encryption StandardDigital SignaturesEncryption vs DecryptionCryptographic Hash FunctionsIntroduction to CryptographyPublic Key Infrastructure (PKI)RSA AlgorithmSymmetric Key CryptographyIntroduction to Access ControlAttribute-Based Access Control (ABAC)Discretionary Access Control (DAC)Mandatory Access Control (MAC)Role-Based Access Control (RBAC) — Information SecurityZero Trust Security ArchitectureFirewalls in Network SecurityIntrusion Detection Systems (IDS)Intrusion Prevention Systems (IPS)Network Monitoring and AnalysisNetwork Security BasicsSecure Network DesignVirtual Private Networks (VPN)Wireless Network SecurityAPI SecurityIntroduction to Application SecuritySecurity Code ReviewDependency and Supply Chain SecurityDynamic Application Security Testing (DAST)Secure Software Development LifecycleStatic Application Security Testing (SAST)Web Authentication MechanismsCross-Site Scripting (XSS)Cross-Site Request Forgery (CSRF)File Upload SecurityHTTPS and SSL/TLSSecure Coding Practices — Information SecuritySession Management SecuritySQL Injection Attacks and PreventionIntroduction to Web SecurityOS Access Control ModelsEndpoint SecurityFile System Permissions and SecurityLinux SecurityIntroduction to OS SecurityUser Account ManagementWindows SecurityCloud Security FundamentalsCloud Security Best PracticesContainer Security — Information SecurityData Security in the CloudCloud Identity and Access ManagementKubernetes SecurityShared Responsibility Model — Information SecurityIntroduction to Digital ForensicsDisk ForensicsDigital Evidence CollectionDigital Forensic ToolsIncident Investigation ProceduresMemory ForensicsNetwork ForensicsContainment StrategiesDetection and Analysis PhaseEradication and RecoveryIntroduction to Incident ResponseIncident Response LifecycleIncident Response PlaybooksPost-Incident Review and Lessons LearnedBusiness Continuity PlanningDisaster Recovery PlanningRisk Assessment MethodologyIntroduction to Risk ManagementSecurity ControlsThreat ModelingVulnerability AssessmentCompliance ManagementGDPR Data Protection OverviewISO 27001 Information Security ManagementNIST Cybersecurity FrameworkSecurity Audits and AssessmentsSecurity GovernanceSecurity Policies and StandardsCloud Security Interview QuestionsCryptography Interview QuestionsInformation Security CheatsheetInformation Security Interview QuestionsNetwork Security Interview QuestionsGlossary of Information Security TermsImportant Security Concepts ReferenceRecommended Books and Learning ResourcesSecurity Tools OverviewIncident Response LabLog Analysis ProjectNetwork Monitoring ProjectPassword Manager ProjectSecure Login System ProjectVulnerability Scanner ProjectInsider ThreatsMalware Types and AnalysisPhishing Attacks and PreventionRansomware AttacksSecurity Threats OverviewSocial Engineering AttacksSpyware and Surveillance SoftwareTrojan Horse MalwareComputer VirusesNetwork Worms
Understanding MAC systems where access decisions are enforced by the system based on security labels, covering Bell-LaPadula, Biba models, and SELinux.
Overview
In MAC, the system enforces access policies that cannot be overridden by resource owners. Access decisions are based on security labels (classifications) assigned to both subjects and objects by a security administrator.
MAC Model
============
Security Administrator assigns labels
Subject (User) → Security Clearance: "Secret"
Object (File) → Classification: "Confidential"
System enforces
If Clearance >= Classification → Access GRANTED
If Clearance < Classification → Access DENIED
Owner CANNOT override this decision!
Bell-LaPadula Model (Confidentiality)
Bell-LaPadula Rules
======================
Security Levels: Top Secret > Secret > Confidential > Unclassified
Simple Security Rule ("No Read Up")
A subject can only READ objects at or BELOW their clearance level.
Secret clearance → Can read Secret and below, NOT Top Secret
*-Property ("No Write Down"):
A subject can only WRITE to objects at or ABOVE their clearance level.
Secret clearance → Can write to Secret and above, NOT Confidential
Purpose: Prevents information from flowing DOWN (protects confidentiality)
Example
User: Secret clearance
✓ Read Confidential document
✓ Read Secret document
✗ Read Top Secret document
✗ Write to Confidential document (would leak Secret info down)
✓ Write to Secret document
✓ Write to Top Secret document
Biba Model (Integrity)
Biba Integrity Rules
=======================
Integrity Levels: High > Medium > Low
Simple Integrity Axiom ("No Read Down")
Subject can only READ objects at or ABOVE their integrity level.
Medium integrity → Can read Medium and High, NOT Low
*-Integrity Axiom ("No Write Up"):
Subject can only WRITE to objects at or BELOW their integrity level.
Medium integrity → Can write to Medium and Low, NOT High
Purpose: Prevents corruption from flowing UP (protects integrity)
Bell-LaPadula vs Biba (opposite rules!):
Bell-LaPadula: No read up, no write down (confidentiality)
Biba: No read down, no write up (integrity)
SELinux Implementation
bash example
# SELinux security context format:
# user:role:type:level
# View file context
$ ls -Z /etc/passwd
system_u:object_r:passwd_file_t:s0 /etc/passwd
# View process context
$ ps -eZ | grep httpd
system_u:system_r:httpd_t:s0 /usr/sbin/httpd
# SELinux policy rule:
# allow httpd_t passwd_file_t : file { read getattr };
# (httpd process can read passwd file, nothing else)
# If httpd is compromised, attacker still cannot:
# - Read /etc/shadow (shadow_t, not allowed)
# - Write to /var/www (httpd_sys_content_t write denied)
# - Execute arbitrary binaries (confined to httpd_t domain)Python MAC Simulation
Example
class MACSystem:
"""Simulate Mandatory Access Control with Bell-LaPadula."""
LEVELS = {"unclassified": 0, "confidential": 1, "secret": 2, "top_secret": 3}
def __init__(self):
self.subjects = {} # {name: clearance_level}
self.objects = {} # {name: classification_level}
def set_clearance(self, subject: str, level: str):
self.subjects[subject] = self.LEVELS[level]
def set_classification(self, obj: str, level: str):
self.objects[obj] = self.LEVELS[level]
def can_read(self, subject: str, obj: str) -> bool:
"""Bell-LaPadula: No read up (simple security)."""
subj_level = self.subjects.get(subject, 0)
obj_level = self.objects.get(obj, 0)
return subj_level >= obj_level # Can read at or below clearance
def can_write(self, subject: str, obj: str) -> bool:
"""Bell-LaPadula: No write down (*-property)."""
subj_level = self.subjects.get(subject, 0)
obj_level = self.objects.get(obj, 0)
return subj_level <= obj_level # Can write at or above clearance
def access_decision(self, subject: str, obj: str, action: str) -> dict:
result = {
"subject": subject,
"subject_clearance": [k for k, v in self.LEVELS.items() if v == self.subjects.get(subject, 0)][0],
"object": obj,
"object_classification": [k for k, v in self.LEVELS.items() if v == self.objects.get(obj, 0)][0],
"action": action,
}
if action == "read":
result["allowed"] = self.can_read(subject, obj)
result["rule"] = "Simple Security (No Read Up)"
elif action == "write":
result["allowed"] = self.can_write(subject, obj)
result["rule"] = "*-Property (No Write Down)"
return result
# Demo
mac = MACSystem()
mac.set_clearance("general", "top_secret")
mac.set_clearance("officer", "secret")
mac.set_clearance("soldier", "confidential")
mac.set_classification("battle_plans", "top_secret")
mac.set_classification("mission_briefing", "secret")
mac.set_classification("daily_orders", "confidential")
# Test access
tests = [
("officer", "daily_orders", "read"), # Can read below clearance
("officer", "battle_plans", "read"), # Cannot read above clearance
("officer", "daily_orders", "write"), # Cannot write below clearance
("officer", "mission_briefing", "write"), # Can write at clearance
]
for subj, obj, action in tests:
result = mac.access_decision(subj, obj, action)
status = "✓ ALLOWED" if result["allowed"] else "✗ DENIED"
print(f" {subj} {action} {obj}: {status} ({result['rule']})")
Interview Questions
- What is the fundamental difference between MAC and DAC?
- In DAC, resource owners control access (discretionary). In MAC, the system enforces access based on security labels assigned by administrators — owners cannot override the system policy. MAC prevents information flow violations that DAC cannot.
- Explain the Bell-LaPadula "no read up, no write down" rules.
- No read up: Users cannot read data above their clearance (prevents unauthorized access to sensitive information). No write down: Users cannot write to lower classifications (prevents leaking sensitive information to less-secure locations). Together they enforce confidentiality.
- Why are Bell-LaPadula and Biba considered complementary?
- Bell-LaPadula protects confidentiality (prevents unauthorized disclosure). Biba protects integrity (prevents unauthorized modification). They have opposite rules because the information flow concerns are inverted. A complete system might implement both.
- How does SELinux implement MAC on Linux?
- SELinux assigns security contexts (labels) to all processes and files. Policy rules define which process types can access which file types and with what permissions. Even root processes are confined to their security domain, preventing privilege escalation beyond the policy.
- What are the practical limitations of MAC?
- Complex to administer, rigid (may impede productivity), difficult to define all necessary policies upfront, users may find workarounds, and the "no write down" rule can prevent legitimate business operations. Often combined with RBAC for practical deployments.
Exam Focus
Revise definitions, diagrams, examples, and short-answer points for Mandatory Access Control (MAC).
Interview Use
Prepare one clear explanation, one practical example, and one common mistake for this Information Security topic.
Search Terms
information-security, information security, information, security, access, control, mandatory, mac
Related Information Security Topics
Continue learning this concept
Access ControlIntroduction to Access ControlComprehensive overview of access control concepts, models, and mechanisms for controlling who can access resources in information systems.Access ControlAttribute-Based Access Control (ABAC)Understanding ABAC policies that evaluate multiple attributes of subjects, resources, actions, and environment for fine-grained access decisions.Access ControlDiscretionary Access Control (DAC)Understanding DAC where resource owners control access permissions, including Unix file permissions, Windows ACLs, and security implications.Access ControlRole-Based Access Control (RBAC) — Information SecurityUnderstanding RBAC implementation, role hierarchies, permission assignment, and best practices for enterprise access management.Access ControlZero Trust Security ArchitectureComprehensive guide to Zero Trust principles including never trust always verify, microsegmentation, continuous authentication, and implementation strategies.Operating System SecurityOS Access Control ModelsImplementing access control at the operating system level including DAC, MAC, capabilities, and security policies.