Embed Notice

@dalias Access control is primarily for securing userspace rather than the kernel itself. SELinux offers a large amount of capabilities for securing userspace which aren't available through other access control mechanisms. Linux doesn't have any modern object capability system and there would still be a need for static, declarative policies if it did. Android also heavily uses SELinux for kernel attack surface reduction too. There isn't any serious alternative upstream. It's the only option.