Glossary
SELinux
A Linux kernel security module enforcing mandatory access control through labels and policy, confining processes beyond standard permissions.
SELinux (Security-Enhanced Linux) is a kernel security module that implements Mandatory Access Control (MAC). Every process and object carries a security label, and a central policy decides which interactions are allowed, regardless of traditional Unix file permissions. This confines services so that even a compromised process can only touch what its policy explicitly permits.
It solves the problem of overly broad discretionary permissions. You can check its mode with getenforce and review denials in the audit log; enforcing mode actively blocks unauthorized actions.