> OSes should move to the opposite strategy, enumerating exactly what is allowed SELinux tries to do that, on a coarse level (but can't prevent user-inflicted

> OSes should move to the opposite strategy, enumerating exactly what is allowed SELinux tries to do that, on a coarse level (but can't prevent user-inflicted problems).