SELinux (Security-Enhanced Linux) is a mandatory access control mechanism that strengthens container isolation. It attaches labels to files, system resources, users, and processes, then permits access only when those labels satisfy defined policies. section 2.3.4
SELinux controls access through:
- Labels attached to subjects and objects, including users, processes, files, and system resources. section 2.3.4
- Policies that determine whether the labels involved permit a requested access. section 2.3.4
- Mandatory enforcement that adds protection beyond the isolation provided by namespaces and other container mechanisms. section 2.3.4 section 2.4
SELinux and AppArmor
Both SELinux and AppArmor strengthen operating-system and container security. SELinux uses labels and applies policies to users and processes; AppArmor uses file paths and focuses on processes. section 2.3.4
