Most system administrators generally work only with basic Discretionary Access Control (DAC) to control the permission of files and directories. On the operating system that uses DAC, the user can control the permissions of the files, typically via chmod or chown commands.
However, just relying on discretionary access control is not adequate, especially at an enterprise level. There needs to be a more granular refinement in permissions. Let's look into one such use case where DAC will not help:
Every program run by the user inherits all the permissions of the user. There are many programs such as Apache that must run as root user. In such a case, Apache will inherit all the permissions of the root user. Since Apache is a web server and lots of people outside your network will communicate with it to see web pages, if a malicious hacker compromises the Apache process...
