“Lately, I’ve concluded that every implementation with difficult-to-configure policies is just unmanageable.”
He spent years defending SELinux’s complexity before giving up. Too many troubleshooting threads end with setenforce 0. Security that experts can’t configure gets switched off by everyone else. A lock nobody can operate is a door left open.