Filesystems on Linux originate from mount, with the exception of ramdisk rootfs on Android. Filesystems on Linux vary drastically. In general, in order to support all the features of SELinux, you need a filesystem with the support for xattr and the security namespace. We saw this requirement when we were setting up the kernel configuration.

Filesystem objects, as they are created, all start with an initial context, just like all other kernel objects. Contexts on files simply inherit from their parent, so if the parent is unlabeled, then the child is unlabeled, with the exception of a type transition rule. Typically, if the context is unlabeled, it infers that the data was created on a filesystem prior to enabling SELinux support, or the type label in the xattr does not exist in the currently loaded policy.

The initial label or initial security id (sid), is in the sepolicy file initial_sid_contexts. Each object class has its associated initial sid present. For example,...