Enabling MCS for Users

MCS is active by default in SELinux, but isn't configured for users. To configure MCS for users, you must create a policy module that adds a rule to assign the mcs_constrained_type attribute to the user domain.

Create a file that contains the rule, for example:

echo '(typeattributeset mcs_constrained_type (user_t))' > local_mcs_user.cil

Load the new policy module.
```
sudo semodule -i local_mcs_user.cil
```
Verify that the mcs_constrained_type is now applied to user_t domain.
```
seinfo -xt user_t|grep mcs_constrained_type
```

You can add the mcs_constrained_type attribute to any other SELinux domain in the same way.