You understood exactly and apparmor clearly fits what I need (and possibly the other two too but I haven't had time to look...). I used to (incorrectly) believe

You understood exactly and apparmor clearly fits what I need (and possibly the other two too but I haven't had time to look...). I used to (incorrectly) believe that SELinux only dealt with networking...