[SELinux rules] invariably written by people other than the authors of the programs Isn't this the core of the solution? Why shouldn't the authors of the progr

[SELinux rules] invariably written by people other than the authors of the programs Isn't this the core of the solution? Why shouldn't the authors of the program themselves supply the expected boundaries of the program they've written? Point is, SELinux is not bound by the same problem you explain: it uses exec() as a domain boundary, so a PDFviewer calling gunzip would transition to the gunzip enforcement domain (if so configured), allowing both gunzip and the PDFviewer to run with minimal permissions.