> SELinux isn't about immutability, it's about program confinement. The mechanisms that allow for program confinement also allow you to construct an immutable

> SELinux isn't about immutability, it's about program confinement. The mechanisms that allow for program confinement also allow you to construct an immutable OS. > Running each daemon in its own fs/user/net namespace comes a lot closer to mimicking the value of SELinux than making the OS immutable. Maybe, but it's still pretty far off. SELinux is about removing DAC/an all powerful user much more than it is about sandboxing.