1. A method comprising: identifying, by an operating system executing on a computing device, a request of a process to create a new object in a file system of the computing device, the new object having a name; identifying, by the operating system, a policy rule applicable to the new object using a label of the process, a label of a parent object pertaining to the new object, a class of the new object, and the name of the new object; creating, by the operating system, a label for the new object using the applicable policy rule; and associating, by the operating system, the new object with the created label.