There is plenty of general advice around, but a complete lack of actionable steps to take.
Or even just:
http://danwalsh.livejournal.com/28545.html
...an selinux sandbox without the containers stuff.
Reply on news.ycombinator.com