SELinux is an implementation of the Mandatory Access Control security model in the Linux kernel. It bears more weight than the Discretionary Access Control security model, implemented as the Unix-based file permissions (ugo, rwx); To illustrate the power of SELinux, a Linux user, even the root account, gets denied access to his own files if the result of the SELinux authorization chain is a deny.

SELinux assigns a context (aka label) to every Linux user, process, file, directory, port, socket, hardware device, etc. These are considered as either subjects (Linux users and processes) or objects (files, directories, ports, …).