SE Linux

A Linux kernel feature enforcing mandatory access control policies on processes and files.

SELinux adds mandatory access control to Linux, labeling processes and resources and enforcing a central policy that confines what each program can do even when it runs as a privileged user. This containment limits the damage of a compromised service, since an exploited daemon is restricted to its policy domain. It operates in enforcing, permissive, or disabled modes, and is a common hardening measure on servers. On the exam, link SELinux to mandatory access control and host hardening, contrasting it with discretionary access control.