Heard the same about SELinux. Typical application attack path: RCE in the app -> ability to use anything in the OS under the app user privileges -> privilege

Heard the same about SELinux. Typical application attack path: RCE in the app -> ability to use anything in the OS under the app user privileges -> privilege escalation -> The whole box pwned (including access to all your secrets and management credentials) Remediation process: wipe the box Attack path for an app within a jail: RCE in the app -> ability to use anything in the OS but there is nothing to use, must bring own tools (not always feasible) -> privilege escalation -> JAIL is pwned but not the box Remediation process: recreate the jail