强制访问控制（英语：mandatory access control，缩写MAC）在计算机安全领域指一种由操作系统约束的存取控制，目标是限制主体或发起者访问或对对象或目标执行某种操作的能力。在实践中，主体通常是一个进程或线程，对象可能是文件、目录、TCP/UDP端口、共享内存段、I/O设备等。主体和对象各自具有一组安全属性。每当主体尝试访问对象时，都会由操作系统内核强制施行授权规则——检查安全属性并决定是否可进行访问。任何对象对任何对象的任何操作都将根据一组授权规则（也称策略）进行测试，决定操作是否允许。在数据库管理系统中也存在访问控制机制，因而也可以应用强制访问控制；在此环境下，对象为表、视图、过程等。
The Common Criteria is based on this science and it intended to preserve the Assurance Level as EAL levels and the functionality specifications as Protection Profiles. Of these two essential components of objective robustness benchmarks, only EAL levels were faithfully preserved. In one case, TCSEC level C2 (not a MAC capable category) was fairly faithfully preserved in the Common Criteria, as the Controlled Access Protection Profile (CAPP). Multilevel security (MLS) Protection Profiles (such as MLSOSPP similar to B2) is more general than B2. They are pursuant to MLS, but lack the detailed implementation requirements of their Orange Book predecessors, focusing more on objectives. This gives certifiers more subjective flexibility in deciding whether the evaluated product’s technical features adequately achieve the objective, potentially eroding consistency of evaluated products and making it easier to attain certification for less trustworthy products. For these reasons, the importance of the technical details of the Protection Profile is critical to determining the suitability of a product.Such an architecture prevents an authenticated user or process at a specific classification or trust-level from accessing information, processes, or devices in a different level. This provides a containment mechanism of users and processes, both known and unknown (an unknown program (for example) might comprise an untrusted application where the system should monitor and/or control accesses to devices and files).
A few MAC implementations, such as 優利系統' Blacker project, were certified robust enough to separate Top Secret from Unclassified late in the last millennium. Their underlying technology became obsolete and they were not refreshed. Today there are no current implementations certified by TCSEC to that level of robust implementation. However, some less robust products exist.
- Amon Ott's RSBAC (Rule Set Based Access Control) provides a framework for Linux kernels that allows several different security policy / decision modules. One of the models implemented is Mandatory Access Control model. A general goal of RSBAC design was to try to reach (obsolete) Orange Book (TCSEC) B1 level. The model of mandatory access control used in RSBAC is mostly the same as in Unix System V/MLS, Version 1.2.1 (developed in 1989 by the National Computer Security Center of the USA with classification B1/TCSEC). RSBAC requires a set of patches to the stock kernel, which are maintained quite well by the project owner.
- An 美国国家安全局 research project called SELinux added a Mandatory Access Control architecture to the Linux内核, which was merged into the mainline version of Linux in August 2003. It utilizes a Linux 2.6 kernel feature called LSM (Linux Security Modules interface). Red Hat Enterprise Linux version 4 (and later versions) come with an SELinux-enabled kernel. Although SELinux is capable of restricting all processes in the system, the default targeted policy in RHEL confines the most vulnerable programs from the unconfined domain in which all other programs run. RHEL 5 ships 2 other binary policy types: strict, which attempts to implement 最小权限原则, and MLS, which is based on strict and adds MLS[需要消歧义] labels. RHEL 5 contains additional MLS enhancements and received 2 LSPP/RBACPP/CAPP/EAL4+ certifications in June 2007.
- TOMOYO Linux is a lightweight MAC implementation for Linux and 嵌入式Linux, developed by NTT Data Corporation. It has been merged in Linux Kernel mainline version 2.6.30 in June 2009. Differently from the label-based approach used by 安全增强式Linux, TOMOYO Linux performs a pathname-based Mandatory Access Control, separating security domains according to process invocation history, which describes the system behavior. Policy are described in terms of pathnames. A security domain is simply defined by a process call chain, and represented as a string. There are 4 modes: disabled, learning, permissive, enforcing. Administrators can assign different modes for different domains. TOMOYO Linux introduced the "learning" mode, in which the accesses occurred in the kernel are automatically analyzed and stored to generate MAC policy: this mode can be used as first step of policy writing, making it easy to customize later.
- SUSE (now[update] supported by Novell) and Ubuntu 7.10 have added a MAC implementation called AppArmor. AppArmor utilizes a Linux 2.6 kernel feature called LSM (Linux Security Modules interface). LSM provides a kernel API that allows modules of kernel code to govern ACL (DAC ACL, access control lists). AppArmor is not capable of restricting all programs and is optionally in the Linux kernel as of version 2.6.36.
- Linux and many other Unix distributions have MAC for CPU (multi-ring), disk, and memory; while OS software may not manage privileges well, Linux became famous during the 1990s as being more secure and far more stable than non-Unix alternatives. Linux distributors disable MAC to being at best DAC for some devices - although this is true for any consumer electronics available today.
- grsecurity is a patch for the Linux kernel providing a MAC implementation (precisely, it is a RBAC implementation). Hardened Gentoo offers a pre-patched kernel with grsecurity. grsecurity is not implemented via the LSM API.
- 微软 Starting with Windows Vista and Server 2008 Windows incorporates 强制完整性控制, which adds Integrity Levels (IL) to processes running in a login session. MIC restricts the access permissions of applications that are running under the same user account and which may be less trustworthy. Five integrity levels are defined: Low, Medium, High, System, and Trusted Installer. Processes started by a regular user gain a Medium IL; elevated processes have High IL. While processes inherit the integrity level of the process that spawned it, the integrity level can be customized on a per-process basis: e.g. IE7 and downloaded executables run with Low IL. Windows controls access to objects based on ILs, as well as for defining the boundary for window messages via 用户界面特权隔离. Named objects, including files, registry keys or other processes and threads, have an entry in the ACL governing access to them that defines the minimum IL of the process that can use the object. MIC enforces that a process can write to or delete an object only when its IL is equal to or higher than the object’s IL. Furthermore, to prevent access to sensitive data in memory, processes can’t open processes with a higher IL for read access.
- FreeBSD supports Mandatory Access Control, implemented as part of the TrustedBSD project. It was introduced in FreeBSD 5.0. Since FreeBSD 7.2, MAC support is enabled by default. The framework is extensible; various MAC modules implement policies such as Biba and Multi-Level Security.
- Sun's Trusted Solaris uses a mandatory and system-enforced access control mechanism (MAC), where clearances and labels are used to enforce a security policy. However note that the capability to manage labels does not imply the kernel strength to operate in Multi-Level Security mode[來源請求]. Access to the labels and control mechanisms are not[來源請求] robustly protected from corruption in protected domain maintained by a kernel. The applications a user runs are combined with the security label at which the user works in the session. Access to information, programs and devices are only weakly controlled[來源請求].
- Apple's Mac OS X MAC framework is an implementation of the FreeBSD MAC framework. A limited high-level sandboxing interface is provided by the command-line function sandbox_init. See the sandbox_init manual page for documentation.
- Oracle Label Security is an implementation of mandatory access control in the Oracle数据库.
- SE-PostgreSQL is a work in progress as of 2008-01-27, providing integration into SE-Linux. It aims for integration into version 8.4, together with row-level restrictions.
- Trusted RUBIX is a mandatory access control enforcing DBMS that fully integrates with SE-Linux to restrict access to all database objects.
- Astra Linux OS developed for 俄罗斯陆军 has its own mandatory access control.
- Smack (Simplified Mandatory Access Control Kernel) is a Linux内核 security module that protects data and process interaction from malicious manipulation using a set of custom mandatory access control rules, with simplicity as its main design goal. It has been officially merged since the Linux 2.6.25 release.
- Technical Rational Behind CSC-STD-003-85: Computer Security Requirements. 1985-06-25 [2008-03-15]. （原始内容存档于July 15, 2007）.
- The Common Criteria Portal. [2008-03-15].
- US Department of Defense. DoD 5200.28-STD: Trusted Computer System Evaluation Criteria. December 1985 [2008-03-15].
- Controlled Access Protection Profile, Version 1.d. National Security Agency. 1999-10-08 [2008-03-15].
- Protection Profile for Multi-Level Operating Systems in Environments Requiring Medium Robustness, Version 1.22. National Security Agency. 2001-05-23 [2008-03-15].
- National Information Assurance Partnership. The Common Criteria Evaluation and Validation Scheme Validated Products List. [2008-03-15]. （原始内容存档于2008-03-14）.
- TOMOYO Linux, an alternative Mandatory Access Control. Linux 2 6 30. Linux Kernel Newbies.
- Linux 2.6.36 released 20 October 2010. Linux 2.6.36. Linux Kernel Newbies.
- Why doesn't grsecurity use LSM?.
- Matthew Conover. Analysis of the Windows Vista Security Model. 赛门铁克. [2007-10-08].
- Steve Riley. Mandatory Integrity Control in Windows Vista. [2007-10-08].
- Mark Russinovich. PsExec, User Account Control and Security Boundaries. [2007-10-08].
- TrustedBSD Project. TrustedBSD Mandatory Access Control (MAC) Framework. [2008-03-15].
- sandbox_init(3) man page. 2007-07-07 [2008-03-15].
- Security Enhanced PostgreSQL.
- Trusted RUBIX.
- （俄文） Ключевые особенности Astra Linux Special Edition по реализации требований безопасности информации
- Official SMACK documentation from the Linux source tree. （原始内容存档于2012-09-21）.
- Jonathan Corbet. More stuff for 2.6.25. （原始内容存档于2012-09-21）.
- P. A. Loscocco, S. D. Smalley, P. A. Muckelbauer, R. C. Taylor, S. J. Turner, and J. F. Farrell. The Inevitability of Failure: The Flawed Assumption of Security in Modern Computing Environments. In Proceedings of the 21st National Information Systems Security Conference, pages 303–314, Oct. 1998.
- P. A. Loscocco, S. D. Smalley, Meeting Critical Security Objectives with Security-Enhanced Linux Proceedings of the 2001 Ottawa Linux Symposium.
- ISO/IEC DIS 10181-3, Information Technology, OSI Security Model, Security FrameWorks, Part 3: Access Control, 1993
- Robert N. M. Watson. "A decade of OS access-control extensibility". Commun. ACM 56, 2 (February 2013), 52-63.