What is SELinux and how does it work?

Mandatory access control (MAC) enforcing rules on processes using labels. Policies restrict what a process can do even if it’s root. Modes: enforcing, permissive, disabled.