This was my problem, too. At work, I have written an SELinux module for our java application servers. It properly reduces the permissions from system for the t

This was my problem, too. At work, I have written an SELinux module for our java application servers. It properly reduces the permissions from system for the tomcat startup procedure, and then drops further permissions once the startup procedure actually executes a java binary. This two-step process is mostly necessary because the tomcat startup executes a bunch of shell scripts to setup variables, but I don't want to give the application server any execute-rights. Conceptually, it's not hard to build such a module with some careful consideration about the files and permissions the process needs at different stages - I was surprised by this. But getting this module to work properly was a real hassle, because there's very little practical documentation on this. Quite sad, actually. I want to be as smug as Redhat about SELinux stopping pentesters cold.