MAC

In MAC, a system limits access to specific resources depending on the authorization and sensitivity of the specific resource. It's more policy-based and is implemented using Linux Security Modules (LSM).

Security labels are at the heart of MAC. Every subject is given a level of security clearance (for example, secret or confidential) and each data object gets a security classification. For instance, a user with a security clearance level of confidential who is trying to retrieve a data object with a security classification of top secret is denied access, because their clearance is lower than the classification of the object.

Hence, it is quite obvious that you can use the MAC model mostly in those environments where confidentiality is of the utmost importance (government institutions, and so on).

SELinux and AppArmor are examples of MAC-based commercial systems.

LSM

LSM is a framework for providing an interface for adding MAC on top of DAC. This extra layer...