If you change "contain" to "do", then this is the MAC security model as implemented by SELinux. a culture where upstream writes in more detail what their code

If you change "contain" to "do", then this is the MAC security model as implemented by SELinux. a culture where upstream writes in more detail what their code is supposed to do and downstream enforces that the software indeed does (not do anything beyond) what they specified It didn't lead to fewer updates, it led to less usage of SELinux.