Ideally, that's how SELinux would work as well. The application developer can be the one writing the SELinux config... it's just that in practice, few of them d

Ideally, that's how SELinux would work as well. The application developer can be the one writing the SELinux config... it's just that in practice, few of them do, so it's up to the community to do instead. The rub being that SELinux is mandatory, so if you don't provide some kind of profile, it simply won't run.