SELinux is a Linux feature that:

While SELinux does monitor access, its primary function is *enforcement* (denial), not just warning, and it applies to all users/processes based on policy, not just unprivileged ones trying to gain access.

This statement is incorrect because SELinux policies often combine MAC with other models like Role-Based Access Control (RBAC) and Type Enforcement (TE).

SELinux (Security-Enhanced Linux) is a kernel security module that provides a mechanism for supporting access control security policies, including Mandatory Access Control (MAC). It enforces fine-grained policies that dictate how processes (user space programs and system servers) can interact with files, devices, and other processes, thereby restricting potential damage from compromised services.

SELinux enforces access controls to prevent unauthorized modification of files but doesn't specifically "ensure" non-modification in a way that implies alerting *only* when referenced files are modified; it enforces policy and logs *all* denials.