What is Android SELinux (Security-Enhanced Linux) in its basic form and what does it add beyond traditional Unix DAC (Discretionary Access Control)?

• A.D) SELinux on Android operates in permissive mode by default, logging violations but not blocking them, to avoid compatibility issues.
• B.B) SELinux replaces the traditional Unix UID/GID system; Android apps no longer use UID-based isolation when SELinux is enforced.
• C.C) SELinux only applies to system services; all third-party app processes are exempt from SELinux policy enforcement.
• D.A) SELinux implements Mandatory Access Control (MAC): every process and file has a security label (domain for processes, type for files), and access decisions are based on a policy specifying which domains can access which types. Unlike DAC (where root can bypass any file permission), SELinux enforces policy even on the root user, confining processes to their intended role even if they are compromised.