Standard permissions are DAC (discretionary access control): the owner decides who gets access. SELinux (Security-Enhanced Linux) and AppArmor add MAC (mandatory access control): a system-wide policy limits what each program may do regardless of file ownership, so a compromised web server cannot read files outside what its policy allows. Both checks must pass, so a file can have perfect permissions and still be denied. RHEL-family systems use SELinux; Ubuntu and Debian use AppArmor, which SUSE also used for years, although newer SUSE releases default to SELinux.
Keep reading for free
Create a free StudyToCert account to read the rest of this lesson: 7 more sections, 7 key terms, a real-world example, an exam tip and self-check questions. Every lesson, lab and practice test is free with an account.