For me, nothing too solid but it makes me sleep better. Not so much an attacker but bad actor(s)... It has saved us from having people with expected (limited)

For me, nothing too solid but it makes me sleep better. Not so much an attacker but bad actor(s)... It has saved us from having people with expected (limited) access to systems from spawning services listening on the network that shouldn't be there Granted, we have a default drop policy in the firewall, so it shouldn't really matter in a sense. I like the approach of not having the process rather than preventing access to it The attacks could be worse. For example, some users SSH access was compromised and the attacker wants to use it -- opening a reverse tunnel on localhost out of the environment over their SSH connection... bypassing the usual perimeter for egress. SELinux should provide some nice control over this that would be independent of service