,S,E,LINUX  ,SECURITY-,ENHANCED ,LINUX 
IS THE MANDATORY-ACCESS-CONTROL LAYER
THE ,,NSA OPEN-SOURCED INTO THE KERNEL3
BORN OF THE AGENCY'S ,,FLUX_/,,FLASK
RESEARCH PROTOTYPES1 RELEASED UNDER THE
,,GPL IN ,DECEMBER #BJJJ1 AND MERGED
MAINLINE DURING THE #B4E#B4F DEVELOPMENT
SERIES "<@9#BJJC">4 ,WHERE ,UNIX
PERMISSIONS ASK 8WHO OWNS THIS FILE AND
WHAT DO THE BITS SAY10 ,S,E,LINUX ASKS
8WHAT IS THIS PROCESS'S CONTEXT1 AND
DOES POLICY GRANT THIS EXACT OPERATION0 
A WEB SERVER LABELED HTTPD.-T CAN'T READ
_/ETC_/SHADOW EVEN IF A BUG GIVES IT
ROOT1 BECAUSE NO RULE IN THE POLICY SAYS
IT MAY4
,LABELS1 NOT PATHS
,EVERY SUBJECT "<PROCESS"> AND OBJECT
"<FILE1 SOCKET"> CARRIES A SECURITY
CONTEXT  USER3ROLE3TYPE3LEVEL1 DISPLAYED
BY LS -;,Z AND PS -;,Z4 ,POLICY COMPILES
TYPE-ENFORCEMENT RULES "<ALLOW HTTPD.-T
HTTPD.-SYS.-CONTENT.-T3FILE READ2"> INTO
A BINARY DATABASE THE KERNEL CONSULTS ON
EVERY ACCESS2 DENIALS LAND IN THE AUDIT
LOG AS ,,AVC MESSAGES4 ,DISTRIBUTIONS
SHIP POLICIES  TARGETED "<PROTECT
DAEMONS1 LEAVE USERS LOOSE"> IS THE
,FEDORA_/,,RHEL DEFAULT1 STRICT AND MLS
EXIST FOR HIGH-ASSURANCE WORK4 ,THE
DAILY TOOLS3 SESTATUS1
GETENFORCE_/SETENFORCE1 SEMANAGE1
RESTORECON1 AUDIT#B;ALLOW4
,THE HONEST REPUTATION
,S,E,LINUX EARNED A REPUTATION FOR
HOSTILITY  THE CLASSIC ADMIN FIX OF
8SETENFORCE #J0 IS FAMOUS ENOUGH TO BE A
JOKE  BUT MODERN TARGETED POLICY PLUS
AUDIT#B;ALLOW MAKES IT TRACTABLE1 AND
,ANDROID SHIPS IT ENFORCING ON EVERY
PHONE3 BILLIONS OF DEVICES RUN ,,MAC
WITHOUT KNOWING IT4 ,THE RIVAL IS
,APP,ARMOR "<,DEBIAN_/,UBUNTU_/,,SUSE'S
PATH-BASED ANSWER  SIMPLER1 WEAKER">2
THE SECURITY CHAPTER'S ,,MAC SECTION
COMPARES BOTH4
,SEE ALSO
- ,LINUX ,SECURITY  THE
,,MAC_/LEAST-PRIVILEGE CHAPTER - ,INSIDE
A ,LINUX ,SYSTEM  THE KERNEL LAYER IT
HOOKS - ,PROCESSES  THE SUBJECTS IT
LABELS - ,LINUX  NFTABLES  ,,LUKS