Which access control model does SELinux use?

Role-Based Access Control (RBAC) assigns permissions based on roles, which SELinux can incorporate, but its fundamental enforcement mechanism is MAC, not solely RBAC.

Discretionary Access Control (DAC) allows resource owners to set permissions, which is what standard Unix permissions do, but SELinux's MAC model adds an additional, stricter layer of control that DAC lacks.

SELinux uses a Mandatory Access Control (MAC) model, where security policies are centrally managed and enforced by the system, overriding user discretion. In MAC, every object (like a file) and subject (like a process) has a security label, and the operating system strictly determines access based on these labels and predefined rules, ensuring that even privileged users cannot bypass these controls.

Attribute-Based Access Control (ABAC) defines access based on attributes of users, resources, and environment, which is more dynamic than MAC but not the primary model SELinux directly implements.