What is the difference between discretionary and mandatory access control?

Answer 1

In the most common implementations of Discretionary Access Control, users "own" their directories and the files and programs they contain. They can grant and deny access and execution privileges for these to other users. Users can also be parts of groups. They may be able grant or restrict access to all members of a group.

In Mandatory Access Control the operating system controls the ability of a subject or initiator to access or generally perform some sort of operation on an object or target. The object or target can be something like a process, a file, a directory, a program, or a memory segment. Subjects and objects each have a set of security attributes. Whenever a subject attempts to access an object, an authorization rule enforced by the operating system kernal compares these security attributes to the policy and decides whether the access or operation will be allowed. With mandatory access control, this security policy is centrally controlled by a security policy administrator; users do not have the ability to override the policy and, for example, grant access to files that would otherwise be restricted.