SSCP Systems and Application Security Practice Question

A security administrator is configuring a Linux server to enforce mandatory access control (MAC). Which of the following tools provides MAC on Linux?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

SELinux

SELinux and AppArmor are Linux security modules that implement mandatory access control policies beyond traditional discretionary access control.

Answer analysis

For each option: why learners choose it and why it is or isn't the right answer here.

✗
PAM
Why it's wrong here
PAM handles authentication, account and session management through pluggable modules; it does not label processes or files, so it cannot enforce MAC. It is tempting because PAM controls who may log in and how, and would be the right answer for restricting authentication methods or password policies on the same server.
✗
iptables
Why it's wrong here
iptables filters network packets by addresses, ports and protocols; it never mediates file or process access, so it cannot enforce MAC. It is tempting because it is a Linux security control, but it operates at the network layer. MAC on Linux comes from SELinux or AppArmor policy labels.
✗
chmod
Why it's wrong here
chmod sets discretionary permissions via owner, group and other bits, so any file owner can change them; it enforces no system-wide policy. It is tempting because it controls access, but that is DAC. MAC on Linux is provided by SELinux or AppArmor, which apply administrator-defined labels.
✓
SELinux
Why this is correct
SELinux enforces mandatory access control through type enforcement, role-based access control and multi-level security, applying kernel-level policy labels that constrain every process and file regardless of user discretion. AppArmor and standard permissions do not provide the same comprehensive MAC model on Linux.

Quick reference

Model	Acronym	Who Controls Access?	Best For
Discretionary Access Control	DAC	Resource owner	Small teams, file shares
Mandatory Access Control	MAC	System / security labels	Classified govt / military
Role-Based Access Control	RBAC	Administrator (via roles)	Enterprise environments
Attribute-Based Access Control	ABAC	Policy engine (user + resource attributes)	Fine-grained, dynamic policies
Rule-Based Access Control	RuBAC	System rules / ACLs	Firewall rules, network ACLs

Go deeper