Linux.com: SELinux: Comprehensive Security at the Price of Usability

“Operating system security revolves around controlling access.
Linux distributions subscribe to the Discretionary Access Control
(DAC) mechanism that lets resource owners decide who gets to access
the resource and how. People soon realized that DAC is not an ideal
solution, as it gives applications the same privileges of the user
running them. One compromised application running as root
effectively compromises the full system. This led security experts
to develop Mandatory Access Control (MAC), which grants access to
resources as defined by a security policy, regardless of the user
running the application. The Security Enhanced Linux (SELinux)
project is the first mainstream implementation of MAC.

“The benefit of SELinux is twofold. First, it replaces the
user-based model with a policy-centric model…”

Complete
Story