Evaluating Runtime Security in DevSecOps Pipelines with SELinux Mandatory Access Control
Runtime security in DevSecOps pipelines remains a significant challenge because widely used tools such as Bandit, Hadolint, and Trivy detect vulnerabilities during development but do not enforce security at execution time. This paper evaluates a three-layer defense-in-depth model combining DevSecOps tools, Linux Discretionary Access Control (DAC), and SELinux Mandatory Access Control (MAC). Experiments were conducted on Flask and Django applications running on Red Hat Enterprise Linux 9.6 with SELinux in enforcing mode. Results show that DevSecOps tools reported warnings but provided no runtime protection, DAC failed under permissive configurations such as chmod 777, and SELinux MAC consistently blocked unauthorized file-write attempts, generating 10,324 AVC denials for Flask and 2,065 for Django. SELinux introduced approximately 50% throughput overhead in Flask, representing a measurable but acceptable trade-off for strong runtime enforcement.