> What happens when you use an editor on some file that is supposed to be > protected, and the editor renames the old file and creates a new one > with the old contents and your changes? Wouldn't the SELinux approach > protect only the old copy? The label will remain attached to the old one. What happens to the new one depends on your SELinux rules.