> - Edit with Vim: `vim foo.c` gives permission to `foo.c`. (Vim also supports opening new files within the editor; in theory that could be redirected to some sort of powerbox, though it's harder than with GUIs.)

Will Vim be allowed to read `~/.vimrc`?

If not, how should I configure Vim system-wide?

(If the answer is "with a daemon", then: is Vim allowed to connect to the daemon and read its configuration?)

If yes, why?

(If the answer is "because you configured the system so", then: how is this different from SELinux?)

Just kidding. :)

The thing is that access to shared state is hard. Any access is a potential security threat.

Finding a balance between functionality and security is one of those areas that I fear are in the NP-hard-equivalent area of system design.