4.1. Authorization, Authentication, and Access Control

Access control is the most fundamental security mechanism in Linux. Every file access, every process spawn, every network connection is evaluated against a permission model. Getting this wrong is the most common source of both security vulnerabilities and operational failures.

💡 First Principle: Linux uses a layered access control model. The Discretionary Access Control (DAC) layer — standard Unix permissions and ACLs — is decided by the file owner. The Mandatory Access Control (MAC) layer — SELinux — is decided by policy, overriding DAC. A process must pass both layers to access a resource.

⚠️ Common Misconception (M5): SELinux in Permissive mode appears to work but enforces nothing — it only logs denials. Many administrators set Permissive mode to "fix" SELinux problems and forget to return to Enforcing. The system logs show what would have been denied, but nothing is actually blocked.