When SELinux is installed on a system are its rules enforced before or after the standard linux permissions? For example if a non-root linux user tries to write to a file with linux permission -rw------- root root will SELinux rules be checked first or will standard filesystem permissions apply and SELinux never invoked?
Are SELinux rules enforced before or after standard linux permissions?
files;permissions;selinux;access control
I see the terms to search for now are MAC and DAC. DAC is the standard permission system. MAC is the system used by SELinux.The answer to quote one source is:It is important to remember that SELinux policy rules are checked  after DAC rules. SELinux policy rules are not used if DAC rules deny  access first.This diagram shows:References:https://selinuxproject.org/page/NB_MAChttps://www.centos.org/docs/5/html/Deployment_Guide-en-US/selg-overview.htmlhttps://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/Security-Enhanced_Linux/chap-Security-Enhanced_Linux-Introduction.html