Directory trees and files have a security context (etc_t, user_home_t, and so on), and there are rules governing which application contexts are allowed to acces

Directory trees and files have a security context (etc_t, user_home_t, and so on), and there are rules governing which application contexts are allowed to access or modify which security contexts. It doesn't cover every edge case, and it can be frustrating to deal with things like local docker development. But the added safety is absolutely worth it to me.