SELinux
kernel-featureopen sourceA label-based Linux Security Module enforcing a comprehensive, system-wide mandatory access policy.
documentedSELinuxProject/selinux README ↗
SELinux is a mandatory-access-control that labels every process and object and enforces a global, admin-defined policy over their interactions. It is the most comprehensive of the classic and the default MAC layer on Fedora/RHEL, where it confines containers (e.g. via container-selinux). Like AppArmor it is privileged and system-wide; policy is written by administrators, not self-imposed by an unprivileged application.
Strengths
- Comprehensive label-based MAC covering the long tail of operations
- Strong container confinement on RHEL/Fedora by default
- Type enforcement contains a compromised process's reach
Limitations
- Privileged, system-wide, and famously complex to author and debug
- Policy is admin-defined, not application-self-imposed like Landlock
- Shared kernel, hardens processes, does not provide a hardware boundary