What is Android SELinux (Security-Enhanced Linux) in its basic form and what does it add beyond traditional Unix DAC (Discretionary Access Control)?

• A.SELinux implements Mandatory Access Control (MAC): every process and file has a security label (domain for processes, type for files), and access decisions are based on a policy specifying which domains can access which types. Unlike DAC (where root can bypass any file permission), SELinux enforces policy even on the root user, confining processes to their intended role even if they are compromised.
• B.SELinux applies to system services alone, because the policy ships with domains defined only for the platform's own daemons (a third-party app runs unconfined by default): every installed app is therefore exempt from it. The gain over DAC is that a compromised system service stays inside its role, and app isolation is left entirely to the uid model beneath it, which is where Android has always drawn that line.
• C.