Linux web servers must confine the web server process with mandatory access control, so that even if the process is compromised it cannot read files outside its labeled context, regardless of standard file ownership. Which operating system security control fits?

Security-Enhanced Linux adds mandatory access control to the Linux kernel. Every process and file carries a security context, and a centrally defined policy determines which contexts may interact; in enforcing mode, the kernel denies anything the policy does not allow, regardless of traditional file ownership or permission bits. A web server process confined to its domain can read only content labeled for it, so even a full compromise of that process cannot reach files outside its context. Group Policy objects manage configuration on Windows systems joined to a directory domain; they are not the mechanism for enforcing mandatory access control on Linux servers. Mobile device management profiles configure and secure phones, tablets and some laptops, providing settings such as passcodes, encryption and remote wipe; they do not confine server processes. Tighter discretionary permissions are still discretionary: the owning account, or a compromised process running as that owner or as root, can change them, which is exactly the weakness mandatory access control is designed to remove. Exam caveat: running in permissive mode only logs violations without blocking them, so it is useful for tuning but provides no protection. Operational check: confirm the system reports enforcing mode, confirm the web server runs in its confined domain, and attempt to read a differently labeled file through the web process to verify the denial appears in the audit log.