Hacker News Reader

Complexity is evil in security, and opt-in security generally doesn't work. SELinux is both complex and opt-in.

You can make it enforce rules strictly over everything, rather than selectively enforce it on specific applications.

no software is written with this in mind, so it wont work right without extensive babysitting (that nobody will do).

SELinux is not opt-in in RedHat-based distros AFAIK.