I was not able to achieve what I wanted with Selinux. As far as I understand it, SeLinux is a blacklist approach, rather than whitelist. You can go far on Linu

I was not able to achieve what I wanted with Selinux. As far as I understand it, SeLinux is a blacklist approach, rather than whitelist. You can go far on Linux without SELinux, by making user accounts for specific applications and tasks. I.e. I have an account just for the browser so if I was affected by 0-day, it reduces the chances of the system being compromised. I have an account for JS projects, so if some npm module has a RAT in it (or deletes everything in the system), it would only be able to access the files in that specific-user directory.